CSP 3 — nonce and 'strict-dynamic' (Google's strict CSP, Cookiebot's policy)

No script violations: 'strict-dynamic' trusts what the nonce'd scripts add. GTM, GA4 and Cookiebot detected; no CSP finding names a script directive.