fix: allow inline event handlers (CSP) — avatar upload + role dropdown were not working
Helmet's default set script-src-attr to 'none', blocking ALL inline event
handlers. As a result, <input onchange="this.form.submit()"> on the avatar
upload (and the role <select>) did nothing: choosing a file did not fire a
submit. Now script-src-attr 'unsafe-inline', consistent with the already
permitted inline <script> (script-src 'unsafe-inline').
Co-Authored-By: Claude <noreply@…>
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
