Let autocomplete selections and ChoiceFilter auto-submit work under the default CSP (WICKET-6938)

[aeonframework]

Resolves WICKET-6938.

Problem

Wicket's default Content Security Policy (strict(): script-src 'strict-dynamic' 'nonce-…') blocks two things wicket-extensions still relies on:

• AutoCompleteTextField selection hooks. AbstractAutoCompleteRenderer#getOnSelectJavaScriptExpression is written into an onselect attribute of each choice, and wicket-autocomplete.js runs it with eval(). Without 'unsafe-eval' that throws, so selecting an item with an expression does nothing, and the only way to use the hook is to weaken the CSP for the whole application. The hook also invites building JavaScript from item data by string concatenation, as its own javadoc examples do; the markup escaping of the attribute does not protect that data once eval() decodes it.
• ChoiceFilter auto-submit. With autoSubmit the select is rendered with onchange="this.form.submit();", an inline handler the CSP blocks, so the filter silently stops submitting on change.

Approach

Two commits, each standing on its own:

1. ChoiceFilter registers the same handler with an OnEventHeaderItem, the way FilterForm#enableFocusTracking already does, so the script carries the CSP nonce. The markup only loses the attribute.
2. Autocomplete dispatches a cancelable, bubbling wicket-autocomplete-select CustomEvent on the input. detail.item is the chosen element and detail.value the text value; a listener may replace detail.value, or call preventDefault() to leave the input unchanged (what returning null from the expression did). Data a listener needs comes from the new AbstractAutoCompleteRenderer#getChoiceData(T), written as markup-escaped data-* attributes whose names must match [a-z][a-z0-9-]*. The listener is registered from renderHead(), so it carries the nonce and nothing is evaluated. The class javadoc shows a complete listener.

getOnSelectJavaScriptExpression is @Deprecated(since = "11.0.0", forRemoval = true) and keeps working where 'unsafe-eval' is allowed: its result becomes the initial detail.value, and the expression still sees the text value as input and arguments[0]. Applications that do not override it see no change.

Migration: move the expression into a wicket-autocomplete-select listener and expose the values it needs through getChoiceData.

Tests

• mvn clean verify -Pjs-test -pl wicket-extensions,testing/wicket-js-tests -amd (JDK 21, after mvn clean install -DskipTests -Pfast): BUILD SUCCESS. wicket-extensions 114/114, wicket-examples 67 run with 0 failures (14 skipped), QUnit 162/162 (jQuery) and 161/161 (vanilla). japicmp and javadoc ran clean.
• New ChoiceFilterTest: checks there is no inline onchange and that the header registers the change handler. It fails on the base code.
• AbstractAutoCompleteRendererTest: checks getChoiceData escaping, skipping of null values, and rejection of invalid attribute names.
• New QUnit autocomplete-test.js + autocomplete.html, wired into Gruntfile.js for both engines and listed in JAVASCRIPTTESTING.md. It covers the event and its detail, a listener replacing the value, a listener cancelling the selection, and a deprecated expression still getting the text value as arguments[0]. Against the base wicket-autocomplete.js its 3 event assertions fail.

Follow-ups

• On master after this lands: remove getOnSelectJavaScriptExpression and the eval() fallback.
• Separate change: core still builds string Ajax call listeners with new Function(), which also needs 'unsafe-eval'.

This change was prepared with AI assistance and reviewed and tested by me.