Sichere Einbindung von Drittanbieter-Skripten mit Nonce-Verifizierung

export function loadSecureScript(url, integrityHash, cspNonce) {
  return new Promise((resolve, reject) => {
    const script = document.createElement('script');
    script.src = url;
    script.integrity = integrityHash;
    script.crossOrigin = 'anonymous';
    if (cspNonce) script.setAttribute('nonce', cspNonce);
    
    script.onload = () => resolve(true);
    script.onerror = () => reject(new Error(`Failed script load: ${url}`));
    document.head.appendChild(script);
  });
}