Non-executable script elements from the macro output are lost in the WYSIWYG editor

Problem

The WYSIWYG editor (CKEditor) replaces every <script> element from the edited content with a protected comment (<!--{cke_protected}...-->), including the script elements found in the read-only output of rendering macros. XWiki only restores the scripts marked with data-wysiwyg="true", and only when the "Load JavaScript Skin Extensions" option is enabled.

So a macro whose output relies on a non-executable script element (a data island such as <script type="application/json">) doesn't behave in the editor as in view mode, because the JavaScript code that enhances the macro output doesn't find its data.

Example

The Live Data macro outputs <script type="application/json" data-config-content-trusted="true|false"></script> to tell the client side whether the HTML content of the live data can be trusted (a script element is used because the HTML sanitizer strips it from untrusted markup, so it can't be forged). When editing a page in-place, this script element is missing, so the Live Data considers its content untrusted and sanitizes the HTML cells (e.g. with the HTML displayer) even if the content is trusted in view mode. Before XWIKI-25425 this was also logging errors in the JavaScript console.

Proposed fix

Restore (unprotect), in the CKEditor data filter, the non-executable script elements (i.e. with a type that is not a JavaScript MIME type or module, e.g. application/json, application/ld+json, text/x-template) that are in the read-only part of the macro output, whatever the "Load JavaScript Skin Extensions" option value:

• the CKEditor protection is a regular expression applied on the whole input HTML before parsing, so the script elements have to be restored after parsing, like unprotectAllowedScripts from the xwiki-filter plugin already does
• executable scripts must remain protected: even if restored they wouldn't run on the initial load (the content is inserted with innerHTML), but they would run unexpectedly in a realtime editing session, because the remote changes are applied with DiffDOM, which creates the script elements with createElement
• scripts inside nested editables must remain protected, because they are part of the saved content
• check that the ACF rule matching the macro output (CKEDITOR.plugins.xwikiMacro.isMacroOutput) keeps the restored script elements
• the macro output is not saved, so this doesn't change the saved content

This is a change applied each time the editor loads content, for all the macros, so it needs to be covered by unit tests (CKEditor plugin tests) and by a functional test (e.g. a trusted Live Data edited in-place).