Move js for POST redirect back to separate file

[greatestape]

This change adopts an earlier implementation we'd explored for the POST redirect page. Rather than embed the JS in an inline script tag, we're shipping it in a separate file.

This is an immediate response to an issue that was flagged in 18.0.0. This fix introduces a race condition for local dev environments. We don't love that, but it's more important to us to make sure that:

1. Our latest release doesn't have a feature that might be incompatible with a consumer's CSP
2. We still have a release out there that unblocks devs who want to update to the latest omniauth

What this PR does

• Move JS for POST redirect back to separate file
• Add file to asset manifest

Reviewer's guide to testing

• Install the gem on an existing app and verify that the oauth install flow still works
  • NOTE: If your local dev env uses the cookie_store session storage strategy, you may encounter 401 errors during oauth due to a race condition between asset requests and /auth/shopify. You should be able to work around for local testing by using a different browser or session storage strategy.
• Disabling source mapping in Chrome should eliminate the local dev race condition

Things to focus on

• Does this change work for apps with Content Security Policies?
• Is the race condition described above acceptable? i.e. is it limited to local dev environments?

Checklist

Before submitting the PR, please consider if any of the following are needed:

• Update CHANGELOG.md if the changes would impact users
• Update README.md, if appropriate.
• Update any relevant pages in /docs, if necessary
• For security fixes, the Disclosure Policy must be followed.

[CautionTapeBot]

We noticed that this PR modifies or enables Subresource Integrity for a script tag.
If the Javascript code is served from another domain (for example our CDN), it will cause a cross-origin error.
This can be solved by setting the crossorigin property to anonymous.

<%= javascript_include_tag ..., integrity: true, crossorigin: 'anonymous' %>

If you have any questions or are unsure about how to move forward with this, ping #help-appsec and we would be happy to help you out. cc: @Shopify/proactive-security

[DAmatheson]

Tested with an app and confirmed this unblocked the install flow when unsafe-inline is disallowed.