Script injected via `javascript:` URIs are not allowed with `strict-dynamic`.