Symfony version(s) affected

7.2.0

Description

Using CSP nonce on importmap generates different script body for the es-module-shim injection code on each request.
This conflicts with @hotwired/turbo element signature check - if the new and the old signature differs, the page is reloaded and not replaced/morphed.
#58121 introduced on-demand loading of the shim - all attributes that are added to the importmap script tag are also added as setAttribute calls in the injected script body.

How to reproduce

1. Use AssetMapper with es-module-shim
2. Use @hotwired/turbo (e.g. with symfony/ux-turbo)
3. Add nonce to the importmap call in twig:

   {{ importmap('app', { nonce: random() }) }}

4. Load the page
5. Navigate to any link - you can see that Turbo fetches the new page - the HeadSnapshot.trackedElementSignature is different for the new page script body for es-module-shim is different, so the browser is navigated to the new page (normaly navigation)

Possible Solution

No response

Additional Context

No response