为CSP添加源后自有资源失效，请求CSP配置协助

我们已启用DataDog进行RUM与性能监控，发现每个会话存在数百条CSP违规记录，具体如下：

connect-src: csp_violation: 'https://browser-intake-us5-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.35.1%2Capi%3Afetch%2Cenv%3Aprod%2Cservice%3Aposterprintshop&dd-api-key=pubc92b8725d106ab061e88cbc0786bb307&dd-evp-origin-version=5.35.1&dd-evp-origin=browser&dd-request-id=c83382e0-3827-4eb8-ac36-5cab3c10b479&batch_time=1746931537872' blocked by 'connect-src' directive

script-src-attr: csp_violation: 'inline' blocked by 'script-src-attr' directive
script-src-attr: 'inline' blocked by 'script-src-attr' directive of the policy "script-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=q..."

script-src-elem: csp_violation: 'https://gs-cdn.optimonk.com/jfclientsdk/latest/103.jfclientsdk-717e15a81d2ef8f985e0.js' blocked by 'script-src-elem' directive

connect-src: csp_violation: 'https://browser-intake-us5-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.35.1%2Capi%3Axhr%2Cenv%3Aprod%2Cservice%3Aposterprintshop&dd-api-key=pubc92b8725d106ab061e88cbc0786bb307&dd-evp-origin-version=5.35.1&dd-evp-origin=browser&dd-request-id=79530d0e-e0d0-4eda-b9ea-d6e2e1c04b62&batch_time=1746954596603' blocked by 'connect-src' directive

script-src: 'eval' blocked by 'script-src' directive of the policy "script-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=q..."
  
at <anonymous> @ https://cdn-gnebp.nitrocdn.com/mYTnTPNQkrxiWdVWqruhWeVAAibiczuV/assets/static/optimized/rev-99cdfb8/posterprintshop.com/wp-content/plugins/jet-menu/assets/public/lib/vue/nitro-min-a1178d1c91e341784b61544886a34b9f.vue.min.js:6:91725

上述违规涉及的脚本来自我们的CDN（Nitropack CDN）、第三方弹窗工具Optimonk、Datadog RUM及Cloudflare，本应被允许运行。

我尝试将这些URL添加到Content Security Policy中，但操作后网站其他资源（JS、CSS等）全部无法加载。

当前HTTP头配置如下：

content-security-policy   upgrade-insecure-requests;
cross-origin-embedder-policy    unsafe-none; report-to='default'
cross-origin-embedder-policy-report-only    unsafe-none; report-to='default'
cross-origin-opener-policy  unsafe-none
cross-origin-opener-policy-report-only  unsafe-none; report-to='default'
cross-origin-resource-policy    cross-origin
permissions-policy  accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=*, publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=*, usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
referrer-policy strict-origin-when-cross-origin
x-cache-ctime   1746925106
x-content-security-policy   default-src 'self'; img-src *; media-src * data:;
x-content-type-options  nosniff
x-frame-options SAMEORIGIN

我添加了Cloudflare、Datadog等站点到CSP，经securityheaders.com检测显示已应用，但网站资源加载失效，不清楚问题所在，请求协助正确配置CSP，允许指定第三方资源同时不影响现有功能。

内容的提问来源于stack exchange，提问作者Brett Henrichsen