Parser-inserted external module scripts do not match the empty-string hash with `strict-dynamic` in the script-src directive.