Remove inline javascript

[ghost]

Problem

As discussed previously, when enabling content security policy, inline JS is considered unsafe.

Reproducible Project

Some lines that are still offending:

https://github.com/rtfd/sphinx_rtd_theme/blob/master/sphinx_rtd_theme/layout.html#L209-L213

The following has a PR already:

https://github.com/rtfd/sphinx_rtd_theme/blob/master/sphinx_rtd_theme/search.html#L15

Error Logs/Results

You get the usual "inline script is blocked by content security policy, etc" which can break functionality.

Expected Results

For the first script, it should be moved to a js_t file. For the latter, upstream changes from Sphinx need to be inherited.

Environment Info

• Python Version: 3.7.2
• Sphinx Version: 1.8.4
• RTD Theme Version: 0.4.3

[Blendify]

Hi would https://github.com/rtfd/sphinx_rtd_theme/blob/master/sphinx_rtd_theme/layout.html#L219 also have to be moved to an external file?

[Blendify]

I opened a WIP PR #729

[ghost]

I haven't used Google Analytics myself, but you may be able to do something like this.

[humitos]

We are deprecating Google Analytics (see #1576) and we moved the generation of the flyout to its own .js file. So, I think we won't have inline javascript when releasing 3.0. However, we should double check it before doing the final release.