strict-dynamic makes the CSP allowlist unnecessary

For years I stuffed long domain lists into script-src. Turns out that with a nonce + strict-dynamic it's pointless: the browser trusts a script carrying a valid nonce, and any scripts it goes on to load inherit that trust automatically. In this mode modern browsers simply ignore the host allowlist.

Content-Security-Policy:
  script-src 'nonce-r4nd0m' 'strict-dynamic';
  object-src 'none';
  base-uri 'self';

Result: a shorter policy and stricter security — an inline injection without a nonce won't run, and there's no CDN list to maintain. In Next.js it's convenient to hand out the nonce via middleware in a request header.