fix(symfony): emit a csp nonce on the swagger ui scripts

[soyuka]

Summary

Under a Content Security Policy such as script-src 'self' 'strict-dynamic', the bundled SwaggerUI <script> tags were blocked because they carried no nonce. They now receive one, reusing existing mechanisms with no new config key:

• a _csp_nonce request attribute (set by a proxy/middleware) takes precedence;
• otherwise the nelmio csp_nonce('script') Twig function is used when available;
• absent both, output is unchanged (no nonce attribute) so plain installs are unaffected.

The csp_nonce() call lives in an include()'d child template (csp-nonce.html.twig) because a literal csp_nonce() in the main template would throw a Twig SyntaxError at parse time when the function is not registered — a runtime {% if %} guard does not prevent parse-time failure.

Reproduction

Visiting /api with a strict CSP blocked the SwaggerUI scripts (no nonce emitted).

Test plan

• New SwaggerUiCspNonceTest (4 cases): request-attribute nonce, csp_nonce() nonce, request-attr precedence over the function, and no-mechanism → no nonce attribute.
• DocumentationActionTest regression green (9/9).
• PHPStan + php-cs-fixer clean on changed files.

Fixes #8142