[JENKINS-76310] Make secret token work with CSP enforced

[daniel-beck]

https://issues.jenkins.io/browse/JENKINS-76310

Second iteration: No longer uses weird f:validateButton feature. I recommend squash-merging due to unclean history.

Testing done

Manually navigated to the buttons and clicked them, checked CSP findings -- none. Work when CSP is enforced.

Screenshots

I used this opportunity to make the buttons look nicer, now that we're not using f:validateButton anymore.

Before

After

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

[Puffy1215]

We have in the past use LTS versions. I am not sure we want to change that at the moment.

If i am reading this right, the next LTS version to be chose is on 2025/12/10. i would like to know what version is next after 2.528.3. we may end up in situation where we are on a weekly release for multiple months if new LTS version number is lower than 2.540, which in my mind means more maintenance required.

I am not opposed to useing weekly release, but I would like to know when next compatible LTS version would be.

[MarkEWaite]

Next LTS baseline will most likely be 2.541 and will release Jan 21, 2026. Baseline selection happens Dec 10, 2025.

[Puffy1215]

Then i think we have no issue. I think this is important to merge as it is related to security configuration. I will merge when I have a chance to run it.

[daniel-beck]

Obsoleted by 5c0ae56 which solves this entirely client-side. WDYT?

[Puffy1215]

Thank you for your pull request. I left a comment about baseline version. I am curious about your thoughts.

[daniel-beck]

I'll look into making this work without a new baseline at all. There's no real reason for this to not be pure client-side JS, I just kept to the current approach as that's a more straightforward migration.

This will also remove consumers of this feature in plugins, thereby making it easier to just retire it.

[Puffy1215]

I'll look into making this work without a new baseline at all. There's no real reason for this to not be pure client-side JS, I just kept to the current approach as that's a more straightforward migration.

This will also remove consumers of this feature in plugins, thereby making it easier to just retire it.

Thank you. The change looks good. I will merge.