fix: make push work with strict CSP (#20342)

flow-client/src/main/frontend/Flow.ts

@@ -289,6 +289,8 @@ export class Flow {
   private async flowInit(): Promise<AppInitResponse> {
     // Do not start flow twice
     if (!this.isFlowClientLoaded()) {
+      $wnd.Vaadin.Flow.nonce = this.findNonce();
+
       // show flow progress indicator
       this.loadingStarted();
 
@@ -349,15 +351,35 @@ export class Flow {
       script.onload = () => resolve();
       script.onerror = reject;
       script.src = url;
+      const nonce = $wnd.Vaadin.Flow.nonce;
+      if (nonce !== undefined) {
+        script.setAttribute('nonce', nonce);
+      }
       document.body.appendChild(script);
     });
   }
 
+  private findNonce(): string | undefined {
+    let nonce;
+    const scriptTags = document.head.getElementsByTagName('script');
+    for (const scriptTag of scriptTags) {
+      if (scriptTag.nonce) {
+        nonce = scriptTag.nonce;
+        break;
+      }
+    }
+    return nonce;
+  }
+
   private injectAppIdScript(appId: string) {
     const appIdWithoutHashCode = appId.substring(0, appId.lastIndexOf('-'));
     const scriptAppId = document.createElement('script');
     scriptAppId.type = 'module';
     scriptAppId.setAttribute('data-app-id', appIdWithoutHashCode);
+    const nonce = $wnd.Vaadin.Flow.nonce;
+    if (nonce !== undefined) {
+      scriptAppId.setAttribute('nonce', nonce);
+    }
     document.body.append(scriptAppId);
   }