This is for a prototype of integrating https://github.com/rjsf-team/react-jsonschema-form/
which uses ajv which needs such as CSP, see
https://github.com/ajv-validator/ajv/blob/1b07663f3954b48892c7210196f7c6ba08000091/docs/security.md#content-security-policy
for more details

It is probably possible to serve that gadget from an "unsafe" websection
instead of making everything unsafe. If we go this way it seems some inline
styles are sometimes set as well.