`strict-dynamic` does not drop allowed source expressions in `img-src`.