CSP-compatible output via external script for build-docs

When using @redocly/cli build-docs to generate a static HTML file, ReDoc injects the entire rendered state as an inline <script> block:

<script>
  const __redoc_state = { ... }; // entire OpenAPI spec serialized here
  var container = document.getElementById('redoc');
  Redoc.hydrate(__redoc_state, container);
</script>

This inline script violates Content Security Policy (CSP) directives that disallow 'unsafe-inline' for script-src. In many enterprise setups, the CSP is enforced by an API gateway or reverse proxy and cannot be modified by the application team, making it impossible to whitelist inline scripts.

Start by running @redocly/cli build-docs and inspect how the generated static HTML embeds the serialized OpenAPI state and hydration script. Trace the build-docs output path and determine how an external script could replace the inline block. Done means the generated HTML works without requiring 'unsafe-inline' in script-src.