content-security-policy: require-sri-for script style