feat(auth): send a nonce-based CSP on the consent and error pages

[mattzcarey]

The consent and error pages show text anyone can set: a DCR client_name, a Client ID Metadata Document's name and redirect URI, a scope name repeated in an error. It is all escaped. This adds the backstop for a value that ever isn't: only the response's own inline script and styles run.

default-src 'none'; script-src 'nonce-…'; style-src 'nonce-…' https://fonts.googleapis.com;
font-src https://fonts.gstatic.com; img-src 'self'; base-uri 'none'; frame-ancestors 'none'

• Both pages render through renderPage(). It generates the nonce, puts it on the page's only <style> and <script>, and sets the policy on the same response, so no template can carry inline code the policy doesn't allow or forget the nonce. It also escapes the title and sets X-Frame-Options: DENY.

  return renderPage(
    { title: `Authorize ${consent.clientName}`, css, card, script },
    { headers } // beginConsent()'s binding cookie; the policy replaces its frame-ancestors-only one
  )

• The error page's close link used an inline onclick and a javascript: URL. It is now a <button> with a nonced listener, and the page sends form-action 'none'.

• The consent page sends no form-action, on purpose. Chrome applies it to the redirect after a submission too:

  sequenceDiagram
    participant B as Browser, consent page
    participant M as mcp.cloudflare.com
    participant C as Client redirect URI
    B->>M: POST /authorize (Cancel)
    M-->>B: 302
    B->>C: GET ?error=access_denied, form-action must allow C
  

  Loading

  So it would have to list the client's redirect origin, next to Cloudflare's for Continue. The client picks that origin and also supplies the text an injection would come from, so an injected form could post there anyway. CSP can't write an IPv6 loopback address (http://[::1]:…) at all. And the form's only field is a handle bound to this browser.