fix: escape CSP nonce attributes in JSON responses

fix: escape CSP nonce attributes in JSON responses #10554