fix: remove nonce from style-src to allow unsafe-inline to work

src/lib/csp.test.ts

@@ -13,8 +13,7 @@ describe("csp", () => {
 		expect(csp).toContain("script-src");
 		expect(csp).toContain("'nonce-testNonce123'");
 		expect(csp).not.toMatch(/script-src[^;]*'unsafe-inline'/);
-		expect(csp).toContain("style-src 'self' 'nonce-testNonce123'");
+		expect(csp).toContain("style-src 'self' 'unsafe-inline'");
-		expect(csp).not.toMatch(/style-src(?!-attr)[^;]*'unsafe-inline'/);
 		expect(csp).toContain("style-src-attr 'unsafe-inline'");
 		expect(csp).toContain("https://challenges.cloudflare.com");
 		expect(csp).toContain("https://cdn.jsdelivr.net");

src/lib/csp.ts

@@ -19,7 +19,6 @@ export function buildContentSecurityPolicy(nonce: string): string {
 	const styleSrc = [
 		"'self'",
 		"'unsafe-inline'",
-		`'nonce-${nonce}'`,
 		"https://fonts.googleapis.com",
 	].join(" ");