Add Content Security Policy (CSP) nonce support

[oxess]

Summary

This PR enables EasyAdmin to work with strict Content Security Policy headers, particularly when using NelmioSecurityBundle's CSP features.

Problem: Applications with strict CSP policies cannot use EasyAdmin without violations because:

• Script tags lack the required nonce attribute
• Inline onclick handlers are blocked by CSP's script-src directive

Solution:

1. Script Tag Nonce Support

All script tags now conditionally include a nonce attribute when the csp_nonce() Twig function is available:

{% guard function csp_nonce %}
    <script src="app.js" nonce="{{ csp_nonce('script') }}"></script>
{% else %}
    <script src="app.js"></script>
{% endguard %}

2. Inline Event Handler Refactoring

Replaced CSP-violating onclick handlers with data attributes processed by JavaScript:

• data-ea-form-submit="formId" - triggers form submission
• data-ea-navigate="url" - triggers navigation

Backward Compatibility

Fully backward compatible - the {% guard %} tag gracefully skips nonce injection when NelmioSecurityBundle is not installed.

Fixes #7213

[oxess]

@javiereguiluz what do you think?