phpinfo() doesn't play nicely with strict CSPs

Description

The output generated by phpinfo() includes inline styles and data: URLs for two images. While this is self-contained, it's incompatible with Content-Security-Policy headers that are configured securely, specifically, if your CSP doesn't include 'unsafe-inline' for style-src and data: for img-src, the output looks bad:

Two of the 6 locations in the output (i.e. not many) that uses inline styles:

                  <tr>
                    <td class="e">highlight.comment</td>
                    <td class="v">
                        <span style="color: #FF8000">#FF8000</span>
                    </td>
                    <td class="v">
                        <span style="color: #FF8000">#FF8000</span>
                    </td>
                </tr>

styling like this would need to be turned into classes, though as you can see this output already makes use of classes, so this is trivial to fix.

A good way to resolve this would be to extend phpinfo so that it can serve these resources separately depending on the request context, so for example a request that contains a request param like phpinfo=styles could serve the style sheet, and phpinfo=logo could serve a logo image.

This approach would be compatible with a super-strict CSP like this (in fact there's nothing preventing phpinfo from generating this header itself):

Content-Security-Policy: default-src 'none'; image-src 'self'; style-src 'self';

The downside of this approach is that it would end up making multiple requests to serve the same page content. I don't know if there is a way that the existing approach could be preserved while allowing for this more secure approach as well.

An alternative would be for the page to generate CSP nonces or SRI hashes for the data and style elements. That's probably more complicated, though it would allow the page to remain self-contained.

Since phpinfo is a development feature, it's not very important to fix this, but it's an easy opportunity to encourage secure development practices while also making the generated page immune to injections.

從 phpinfo() 入口點開始，追蹤其 HTML、內嵌樣式和 data: 圖片 URL 的產生方式。將可能的資源提供方案以及 nonce 或 hash 方案與 issue 中描述的嚴格 CSP 進行比較。完成標準是產生的頁面在不允許 unsafe-inline 或 data: 的情況下能正確呈現。