`strict-dynamic` allows scripts matching hashes present in the policy.