Nonce to Extra JS from wp_localize_script

Nonces and data are not generally sent as tag attributes, they are typically assigned to JS vars through wp_localize_script(). The only caveat is the function requires an enqueue handle be provided, usually one for your own enqueued script. But you can use handles from other scripts enqueued on the page if you have to.

As for adding actual tag attribute values to the <script> tag, the only way I know (since “wp_script_attributes” does not seem to work as expected) is by outputting the entire <script> block HTML from the “wp_print_scripts” action. The problem in doing this is WP will be unable to resolve any dependencies. But you can somewhat manage where your script appears in relation to others through the $priority arg for add_action().