Keycloak's built-in login/account/admin themes inject inline <script> blocks and dynamically load scripts. This requires 'unsafe-inline' in script-src, which defeats the purpose of having a strict CSP.

Is there any supported mechanism in Keycloak 26.x to inject a per-request CSP nonce
into the built-in themes WITHOUT writing a fully custom theme?

Following up here to understand:

1. Is there any interim workaround available today?
2. Is nonce support planned for any specific upcoming release?
3. Is there a simpler extension point (e.g. a SPI or theme hook) that avoids
   a full theme rewrite?

Any guidance appreciated. Happy to test solutions.