fix(browser): a per-call nonce in getLoadingHtml restarts the spinner during cache reset #287

Follow-up from #275.

Problem

getLoadingHtml used to return a constant string. Since #275 it embeds a fresh nonce on every call (src/providers/componentBrowserProvider.ts:609), so two assignments that look identical now produce different HTML.

The cache-reset path does exactly that, back to back:

• componentBrowserProvider.ts:2511 assigns the loading document
• it then calls loadComponents(true), which assigns it again at componentBrowserProvider.ts:156

Assigning webview.html a different string tears the document down and rebuilds it, so the spinner visibly restarts partway through a cache reset. While the string was constant, the second assignment was a no-op and nothing was visible.

Suggested fix

This document has no <script>, so it does not need a per-render nonce at all. Dropping script-src from its CSP leaves default-src 'none' to block scripts — stricter than a nonce, and it makes the string constant again.

Hoisting a module-level nonce would also work, but it would keep a nonce around for a document that has nothing to grant it to, which is the invariant worth preserving: a nonce exists because a script exists.