Anna Weber

Hi @sebfz1 , thanks for confirming. I believe we could be more compliant here by using our own `HeaderItem` similar to `JavaScriptContentHeaderItem` (instead of the current `StringHeaderItem` which is extended...

> I also use CSP-NONCE and had to .add(CSPDirective.SCRIPT_SRC, CSPDirectiveSrcValue.SELF) to make it work While it might work, it does not comply with a stricter CSP policy. Check the policy...