A separate policy with more nonces works correctly with `strict-dynamic` in the script-src directive.