Culprit: https://github.com/jenkinsci/jdk-tool-plugin/blob/eef9873383a7ca7f01984f9ca5d0355911f8baec/src/main/resources/hudson/tools/JDKInstaller/DescriptorImpl/credentialOK.jelly#L31

Reproduction steps:

• Install Oracle Java SE Development Kit Installer or clone https://github.com/jenkinsci/jdk-tool-plugin and then mvn hpi:run
• Navigate to

  [JENKINS_INSTANCE]/descriptorByName/hudson.tools.JDKInstaller/credentialOK
  

• Click on Close

Screenshot attached about where the feature is displayed.

NOTE: This is actually not working, recent browsers only allow scripts to close windows they opened

Proposal
https://www.jenkins.io/doc/developer/security/csp/#inline-event-handlers

Testing notes

• Ensure to reproduce the feature before any change
• Ensure that you reproduce the feature after you have made the change