[m-develops]

The CSP build replaces x-html with a directive that throws, so apps that use it for trusted HTML render nothing under a CSP. Filament renders its own icon HTML and labels this way, which breaks under Livewire's csp_safe mode.

CSP itself does not restrict what x-html does: the browser still blocks scripts and inline event handlers in the inserted HTML, and Alpine expressions in it go through the CSP evaluator like any other markup. So this removes the override and lets the CSP build use the core directive unchanged. Like in the core build, Alpine attributes in the inserted HTML are initialized, so x-html should only receive trusted content, as its docs already warn.

The test that expected an error now checks that x-html renders and initializes its content in the CSP build, like the core test of the same name.

Discussed with @danharrin in filamentphp/filament#20661.