Address PR #3934 review feedback on canary baseline and nonce escaping

- strict_csp.spec.ts: wait for the streamed content (header + both
  Suspense branches at level 0) to be fully delivered before asserting
  the zero-violation baseline in the enforcement-canary test. Previously
  the baseline ran right after the load event, when streamed chunks
  could still be in transit, making the pre-canary assertion vacuous.
- application_controller.rb: HTML-escape the CSP nonce before
  interpolating it into the script tag attribute. Safe today with
  Rails' base64/session generators, but the raw interpolation was a
  copyable pattern that a custom nonce generator could break out of.

The docs page already shows only the safe helper-based patterns
(javascript_tag/javascript_include_tag with nonce: true), so no docs
change is needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: justin808

react_on_rails_pro/spec/dummy/app/controllers/application_controller.rb

@@ -52,8 +52,11 @@ def stream_prerender_error_response
     # The strict CSP (config/initializers/content_security_policy.rb) blocks
     # inline scripts without the per-request nonce, so this late-streamed error
     # script must carry it. The meta refresh below stays as a no-JS fallback.
+    # html_escape guards against a custom nonce generator emitting characters
+    # (e.g. `"` or `>`) that could break out of the attribute; Rails' built-in
+    # base64/session generators are already safe.
     nonce = content_security_policy_nonce
-    nonce_attribute = nonce.present? ? %( nonce="#{nonce}") : ""
+    nonce_attribute = nonce.present? ? %( nonce="#{ERB::Util.html_escape(nonce)}") : ""
     js_redirect = <<~JAVASCRIPT
       <script#{nonce_attribute}>
         document.getElementById('page-container').innerHTML = #{ActiveSupport::JSON.encode(error_message)};

react_on_rails_pro/spec/dummy/e2e-tests/strict_csp.spec.ts

@@ -135,6 +135,15 @@ test.describe('Strict CSP (script-src self + per-request nonce, no unsafe-inline
   test('the policy is enforced: a nonce-less inline script is blocked (canary)', async ({ page }) => {
     await page.goto(STREAMED_RSC_PAGE);
 
+    // Wait for the streamed content (including the late Suspense boundaries)
+    // to be fully delivered before asserting the empty baseline — otherwise
+    // chunks still in transit could make the pre-canary assertion vacuous.
+    await expect(page.getByText('Header for AsyncComponentsTreeForTesting')).toBeVisible({
+      timeout: 30000,
+    });
+    await expect(page.getByText('branch1 (level 0)')).toBeVisible({ timeout: 30000 });
+    await expect(page.getByText('branch2 (level 0)')).toBeVisible({ timeout: 30000 });
+
     // The page itself must be violation-free before the canary.
     expect(await getUnexpectedCspViolations(page)).toEqual([]);