Merge remote-tracking branch 'origin/main' into w549-inline-scripts

# Conflicts:
#	composer.json
#	share/filelist.md5

Updated: The map escaping and the registration form tests follow the templates that moved their scripts into files

From cjw_themes_jumper 0.1.6 and ezflow 6.1.9 on, the map address reaches the map's
script file in a data attribute instead of an inline script: the test checks it is
escaped for HTML once and that getAttribute() hands setContent() the HTML-escaped
address. From sevenx-themes-media 1.5.70 on, the registration form names its
buttons in data-exp-disable-on-submit and the theme's script disables them on the
next tick; the test reads that script. Older releases are still checked as before.

Updated: Require git_manager 2.0.21, whose commit log has pages and filters by branch, author and message

The dashboard's commit log browses the whole history page by page with the shared admin pager and a page size kept as a preference; page, size and filters are view parameters. GitManagerLogPagingTest checks the paging maths, the view parameters and the git arguments without a database, and the styling test knows the new filter and pager hooks.

Updated: The Content Security Policy guide says what an enforced script-src still needs with the extensions installed

Updated: Require Exponential UI and the site design releases whose templates carry no inline scripts

exp_adminui 1.0.0.40, ezwebin 6.0.22, ezdemo 6.0.12, ezflow 6.1.9,
cjw_themes_jumper 0.1.6, sevenx_themes_simple 1.0.24 and sevenx-themes-media
1.5.70 (and ezfind 3.0.6, ezpm 0.10.1, ezauthorize 1.4.3 where installed) move
their inline scripts and handlers into files. The test lists what is left with
the reason: the TinyMCE 3 start script of Exponential UI and ezwebin's footer
script, which prints code an editor enters as content. expservices is checked too.

Updated: The portal designs set their saved color mode from a script file

The inline script of the expportal_jquery and expportal_reactive pagelayouts that
sets data-theme from localStorage before the first paint is now
javascript/portal/theme_head.js, loaded at the same place in <head> as a blocking
script, so the portal runs under a Content Security Policy with script-src 'self'.

Updated: Require the layouts and the other extension releases whose templates carry no inline scripts

explayouts 1.4.37, explayouts-ui 1.3.20, explayouts-ui-api 1.3.24,
explayouts-content-browser-ui 1.0.8, xrowmetadata 1.4.13, ezstarrating 6.0.12,
bcwebsitestatistics 1.0.12, enhancedezbinaryfile 4.4.8, ezmultiupload 6.1.7,
expui 1.0.0.10, expai 0.0.1.12, expchangeclass 1.0.9 and
sevenx_authentication_2fa 1.0.9 move their inline scripts and handlers into
files; the test holds them to it from these versions on.