[Rom1-B]

Make the plugin compatible with the GLPI Content Security Policy by removing inline event handlers and javascript: links.
Behaviour is unchanged: same URLs, same request fields, same confirmation message.

Converted patterns

• src/Source_Zone.php: the "Download enabled" toggle was a javascript:void(0) link with an onclick (categories a and c). It is now a btn-as-link button with a data-carbon-toggle-zone attribute, and the two existing Html::scriptBlock() scripts bind a click listener to these buttons.
• src/Config.php: Html::getConfirmationOnActionScript() (deprecated, category b) is removed. The Twig variables now carry the confirmation message, the action URL and the JSON fields.
• templates/config.html.twig: the two "Reset impacts" buttons use data-glpi-confirm, data-glpi-submit-get-link and data-glpi-submit-get-link-fields instead of onclick (category a). The unused {% set reset_args %} lines are removed, as they would shadow the context variable.
• templates/environmentalimpact-item.html.twig: the four submitGetLink() onclick handlers (usage and embodied "Reset data" and "Calculate data") use data-glpi-submit-get-link and data-glpi-submit-get-link-fields, with the fields built by Twig json_encode (category a).
• setup.php: 'csp_compliant' => true added to plugin_version_carbon().

Other hits from the searches are not handlers: the <script> tags in templates/**/*.twig are literal template text (nonce added by the template engine), and the Html::scriptBlock() calls already emit a nonce.

Blocked by

• Add content security policy glpi-project/glpi#26020 (CSP) and its 11.0 backport. The data-glpi-confirm and data-glpi-submit-get-link attributes do nothing on releases without the backport, so the confirmation would be silently skipped.
• PLUGIN_CARBON_MIN_GLPI_VERSION must be raised to the first CSP-enabled 11.0 release before merging. It is intentionally left at 11.0.0 in this PR, as the release number does not exist yet.

Manual test checklist

Keep the browser console open. A CSP violation shows as Refused to execute inline event handler or Refused to execute inline script.

1. Open a Carbon source item, go to the zones tab, click Yes/No in the "Download enabled" column. The value toggles and the tab reloads with no console error. Repeat on a Carbon zone item, sources tab.
2. Open the Carbon plugin configuration page. Click "Reset usage impacts": a confirmation dialog appears. Cancel does nothing. Confirm resets the usage impacts. Repeat with "Reset embodied impacts".
3. Open the environmental impact tab of a computer, a monitor and a network equipment. "Calculate data" runs the calculation and "Reset data" (when shown) resets the data, as before.