phpinfo() doesn't play nicely with strict CSPs

Description

The output generated by phpinfo() includes inline styles and data: URLs for two images. While this is self-contained, it's incompatible with Content-Security-Policy headers that are configured securely, specifically, if your CSP doesn't include 'unsafe-inline' for style-src and data: for img-src, the output looks bad:

Two of the 6 locations in the output (i.e. not many) that uses inline styles:

                  <tr>
                    <td class="e">highlight.comment</td>
                    <td class="v">
                        <span style="color: #FF8000">#FF8000</span>
                    </td>
                    <td class="v">
                        <span style="color: #FF8000">#FF8000</span>
                    </td>
                </tr>

styling like this would need to be turned into classes, though as you can see this output already makes use of classes, so this is trivial to fix.

A good way to resolve this would be to extend phpinfo so that it can serve these resources separately depending on the request context, so for example a request that contains a request param like phpinfo=styles could serve the style sheet, and phpinfo=logo could serve a logo image.

This approach would be compatible with a super-strict CSP like this (in fact there's nothing preventing phpinfo from generating this header itself):

Content-Security-Policy: default-src 'none'; image-src 'self'; style-src 'self';

The downside of this approach is that it would end up making multiple requests to serve the same page content. I don't know if there is a way that the existing approach could be preserved while allowing for this more secure approach as well.

An alternative would be for the page to generate CSP nonces or SRI hashes for the data and style elements. That's probably more complicated, though it would allow the page to remain self-contained.

Since phpinfo is a development feature, it's not very important to fix this, but it's an easy opportunity to encourage secure development practices while also making the generated page immune to injections.

从 phpinfo() 入口点开始，跟踪其 HTML、内联样式和 data: 图像 URL 的生成方式。将可能的资源提供方案以及 nonce 或 hash 方案与 issue 中描述的严格 CSP 进行比较。完成标准是生成的页面在不允许 unsafe-inline 或 data: 的情况下能够正确渲染。