There are 2 manifest.json files with different "content_security_policy" settings for test, the one use script-src 'self' to forbid executing inline js, the other use script-src 'unsafe-inline' to allow execute inline js.  So the inline js in csp.html, which changes the page title, will be/not be executed according to the different manifest files.
And these will validate whether the content_security_policy take effect.