Nonced and non parser-inserted scripts should run with `strict-dynamic` in the script-src directive.