This is really great, as it gets us halfway to the finish line. To complete this task, we need to remove the onclick= HTML attribute, and instead set it programmatically from searchscripts.js. To do that, you'll need to use either document.addEventListener('DOMContentLoaded', …) or Behaviour#specify (as described in https://www.jenkins.io/doc/developer/security/csp/#inline-event-handlers) to write some code that runs when the page loads. That code should find the <a> elements whose onclick handlers were removed (e.g. through document.querySelector and iterating by class name or ID), then add a new onclick handler with element.addListener("click", ...). For an example, see:

jenkinsci/scriptler-plugin#120

Once that is done and the result is tested, I am happy to approve this PR.

This is looking almost done. The only task I think is remaining is to follow this advice from the CSP documentation:

For event handlers like onclick that used to call return false to prevent the usual action (e.g. link navigation) from happening, add a call to Event.preventDefault() in a separate event handler on the provided Event argument.

For an example, see:

jenkinsci/workflow-job-plugin#477

After that is done, I think this change is ready to ship.

Thanks for the PR! I trust you can confirm this is all working as expected by manually testing the UI.