Source expressions in a separate policy are honored with `strict-dynamic` in the script-src directive.