Use importmap for avo javascript

Run bin/rails generate avo:js:install then update.

app/controllers/application_controller.rb

@@ -28,9 +28,7 @@ class ApplicationController < ActionController::Base
       :self,
       "'sha256-#{Digest::SHA256.base64digest(Rails.application.importmap.to_json(resolver: ApplicationController.helpers))}'",
       "https://secure.gaug.es",
-      "https://www.fastly-insights.com",
-      "https://unpkg.com/@hotwired/stimulus/dist/stimulus.umd.js",
-      "https://unpkg.com/stimulus-rails-nested-form/dist/stimulus-rails-nested-form.umd.js"
+      "https://www.fastly-insights.com"
     )
   end
 

app/javascript/avo.custom.js

@@ -0,0 +1,4 @@
+import { application } from "controllers/application"
+
+import NestedForm from "stimulus-rails-nested-form";
+application.register("nested-form", NestedForm);

app/views/avo/partials/_head.html.erb

@@ -1,7 +1 @@
-<%= javascript_tag 'avo.custom', defer: true, type: :module, nonce: true do %>
-import * as Stimulus from "https://unpkg.com/@hotwired/stimulus/dist/stimulus.umd.js";
-import * as NestedForm from "https://unpkg.com/stimulus-rails-nested-form/dist/stimulus-rails-nested-form.umd.js";
-
-const application = window.Stimulus.Application.start();
-application.register("nested-form", window.StimulusRailsNestedForm);
-<% end %>
+<%= javascript_importmap_tags "avo.custom" %>

config/importmap.rb

@@ -16,3 +16,7 @@
 pin "github-buttons"
 # vendored from github in the before times, not compatible with newest version without changes
 pin "webauthn-json"
+
+# Avo custom JS entrypoint
+pin "avo.custom", preload: false
+pin "stimulus-rails-nested-form", preload: false # @4.1.0

config/initializers/content_security_policy.rb

@@ -12,12 +12,8 @@
   policy.object_src  :none
   # NOTE: This scirpt_src is overridden for all requests in ApplicationController
   # This is the baseline in case the override is ever skipped
-  policy.script_src :self,
-                    "https://secure.gaug.es",
-                    "https://www.fastly-insights.com",
-                    "https://unpkg.com/@hotwired/stimulus/dist/stimulus.umd.js",
-                    "https://unpkg.com/stimulus-rails-nested-form/dist/stimulus-rails-nested-form.umd.js"
-  policy.style_src   :self, "https://fonts.googleapis.com"
+  policy.script_src :self, "https://secure.gaug.es", "https://www.fastly-insights.com"
+  policy.style_src :self, "https://fonts.googleapis.com"
   policy.connect_src :self, "https://s3-us-west-2.amazonaws.com/rubygems-dumps/", "https://*.fastly-insights.com", "https://fastly-insights.com",
     "https://api.github.com", "http://localhost:*"
   policy.form_action :self, "https://github.com/login/oauth/authorize"