Parser-inserted scripts with a correct nonce are allowed with `strict-dynamic` in the script-src directive.