`strict-dynamic` does not drop whitelists in `img-src`.