Model <meta http-equiv="Content-Security-Policy" content="..."> as an inline asset.