A strict Content-Security-Policy for Astro: hashing inline scripts instead of 'unsafe-inline'
Astro emits inline scripts that a default-src 'none' CSP blocks. Here's how this blog pins per-script SHA-256 hashes in its Cloudflare Pages _headers and keeps 'unsafe-inline' out of script-src.