A separate Report-Only policy does not influence `strict-dynamic` in the script-src directive.