Two CSP headers

Both policies must pass; the injected tags can only carry one nonce.

script-src 'nonce-PFJXf5kA0Sc/dQ8RuQ4/nw==' 'strict-dynamic'
script-src 'nonce-HmvGNHJ5XidLBEcwickNaQ==' 'strict-dynamic'

Loader tag: unknown (inline script blocked?)