Fix CSP problems due to cypress-axe

[richvdh]

Currently, if you try to run the cypress tests without patching the application, you get an error about the CSP:

Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'wasm-unsafe-eval' https://www.recaptcha.net/recaptcha/ https://www.gstatic.com/recaptcha/".

This is because cypress-axe uses an eval call to inject Axe into the application under test, which is forbidden by our CSP.

To solve this, rewrite injectAxe so that injects a <script> element instead.

---

This change is marked as an internal change (Task), so will not be included in the changelog.

[richvdh]

We might be able to get rid of the hacks in the GHA workflow (

matrix-react-sdk/.github/workflows/cypress.yaml

Lines 138 to 140 in a2b8bf9

	# This is necessary as Cypress relies on eval for passing functions between processes
	- name: Allow CSP script-src unsafe-eval
	run: sed -i "s/script-src /script-src 'unsafe-eval' /" webapp/index.html

) once this lands

[t3chguy]

😍

Can we also ditch the CSP modifying sed line? Allow CSP script-src unsafe-eval

[t3chguy]

once this lands

Shouldn't need to wait, the workflow runs off the default branch so runs for this PR will have both your fix and the sed, once it lands just your fix.