feat: make plugin CSP compliant - #279

Checklist before requesting a review

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

Summary: the plugin no longer relies on inline event handlers, so it keeps working once GLPI sends the Content Security Policy (script-src 'nonce-<value>' 'unsafe-eval').
The behaviour is unchanged: the same JavaScript functions are called with the same arguments.

Converted patterns:

• templates/tickets/consume.html.twig
  • onchange on the "Consume a voucher ?" slider (additional_attributes): removed, bound with addEventListener('change') in the template's own <script> block, calling showCreditDiv<rand>(this.value).
  • on_change on the voucher dropdown: removed, bound with jQuery .on('change') on #dropdown_plugin_credit_entities_id<rand> (select2 fires jQuery events), calling getQuantityRemaining<rand>(this.value).
• templates/tickets/form.html.twig
  • on_change on the voucher dropdown: removed, bound with jQuery .on('change') on #dropdown_plugin_credit_entities_id<rand>, calling getQuantityRemainingForm<rand>(this.value, this). The dropdown now receives the template rand explicitly so the id is known.

No PHP output of <script> or handler attributes was found. The two <script> blocks are literal Twig, so the nonce is added at compile time.

Blocked by

• Add content security policy glpi-project/glpi#26020 (CSP for GLPI 11/12/13) and its 11.0 and 12.0 backports, not released yet.
• PLUGIN_CREDIT_MIN_GLPI must be bumped to the first CSP-enabled 11.0 release before merging. This PR adds 'csp_compliant' => true as a draft and does not change the minimum version yet.

Manual test checklist

Keep the browser console open. A CSP violation shows as Refused to execute inline event handler or Refused to execute inline script. None should appear.

1. Ticket, Processing form, "Consume a voucher ?" switch: toggling it shows and hides the voucher block, and enables and disables the quantity field.
2. Same form, choose a voucher: the quantity field appears, is set to 1, and the "Maximum consumable quantity" tooltip shows the value returned by the AJAX call.
3. Same form, choose the empty voucher entry: the quantity field is hidden and set to 0.
4. Ticket, Credit tab, "Add a voucher to the ticket" form: choosing a voucher shows the quantity field with the same behaviour as step 2; choosing the empty entry hides it as in step 3.
5. Submit the Credit tab form and a ticket solution with consumption: the consumption is recorded as before.
6. Browser console: no CSP violation messages on those pages.

Screenshots (if appropriate):