Stan Hu authored 5 years ago and Ash McKenzie committed 5 years ago

A nonce-based Content-Security-Policy thwarts XSS attacks by allowing
inline JavaScript to execute if the script nonce matches the header
value. Rails 5.2 supports nonce-based Content-Security-Policy headers,
so provide configuration to enable this and make it work.

To support this, we need to change all `:javascript` HAML filters to the
following form:

```
= javascript_tag nonce: true do
  :plain
    ...
```

We use `%script` throughout our HAML to store JSON and other text, but
since this doesn't execute, browsers don't appear to block this content
from being used and require the nonce value to be present.

Part of single codebase changes.

Compile highlight CSS separately
Move highlight-specific mixins out of mixins.scss
Rename solarized themes to match theme name as this was a smaller
change than changing all instances to snake_case

Signed-off-by: Rémy Coutable <remy@rymai.me>

the initial reason for this change was that graphicsmagick does not
support writing to ico files. this fact lead to a chain of changes:

1. use png instead of ico (browser support is good enough)
2. render the overlays on the client using the canvas API. this way we
   only need to store the original favion and generate the overlay versions
   dynamically.
   this change also enables (next step) to simplify the handling of the
   stock favicons as well, as we don't need to generate all the versions
   upfront.

The locale code is turned into an asset path with an underscore
instead of a dash.

The language codes are transformed by `I18n.locale` into a code with a
dash. But the resources for translating are always stored in a path
using a `_` separating the language and the region code.

Made the insertion of the English Translation File conditional + removed window.translations from the global object to save some memory

Closes #35985

Remove multiple methods of including monaco related code and remove static monaco assets from public

Signed-off-by: Rémy Coutable <remy@rymai.me>

move webpack publicPath setup earlier in the bootstrap processes to avoid ES module execution order issues