Culprit:

• (1) ApiTokenPropertyConfiguration/config.jelly#L18
• (2) ApiTokenPropertyConfiguration/config.jelly#L32
• (3) ApiTokenPropertyConfiguration/config.jelly#L40

Reproduction steps:

• Install Git or clone https://github.com/jenkinsci/git-plugin and then mvn hpi:run
• Go to Manage Jenkins
• Go to Configure Global Security
• In the "Git plugin notifyCommit access tokens" section, add a new access token
• Click on Generate (Culprit - 2)
• Culprit - 3 is the Revoke button
• Refresh
• The new Revoke button is the Culprit - 1

Screenshot attached about where the feature is displayed.

Proposal
https://www.jenkins.io/doc/developer/security/csp/#inline-event-handlers

Testing notes

• Ensure to reproduce the feature before any change
• Ensure that you reproduce the feature after you have made the change