The simple answer is: sorry, its not simple possible to make this "secure".

The positive side is, you have nearly no user contributed content and therefore this is a rather small downside. At least for the simple and normal case.

I see this is a setting which should absolutely work and be enforced for the admin area, and also in general.

To answer your question, it may be the easiest way to do a feature request in the magento forum and ping some people of the magento community to it. Because, it also needs some advising in the devdocs for module creators, else people would regularly have problems with modules not compatible to this level of security.

Sorry if this is not the answer you would expect. The main problem is probably the javascript and how it is organized, some parts may expect its always and early there. Also, I dont know what changed yet in magento2, but in magento 1 there were also some other places which relayed on inline JS, they may not be completely refactored yet.

etc/csp_whitelist.xml

Need to implement our own whitelist using above file

see https://devdocs.magento.com/guides/v2.4/extension-dev-guide/security/content-security-policies.html

pros:

• format evaluation using schema

cons:

• there is no way to declare schema type entry
• however you can whitelist schemes declaring host with schema name, just need to add : after the schema name eg: <value id="data-schema" type="host">data:</value>

this is the recommended way by Magento

etc/config.xml

whitelist can be declared as config node with specific tags using above file

see vendor/magento/module-csp/etc/config.xml

pros:

• can be inserted to the core_config_data table via environment configuration or data patch

cons:

• if it is stored in DB data patch required to change/modify

Implement custom policy collector

see vendor/magento/module-csp/etc/di.xml and vendor/magento/module-csp/Model/Collector/CspWhitelistXmlCollector.php

• inject your custom collector into collectors argument of Magento\Csp\Model\CompositePolicyCollector.
• Custom collector have to implements Magento\Csp\Api\PolicyCollectorInterface
• insert policies using Magento\Csp\Model\Policy\FetchPolicy

pros:

• you can use nonce type whitelists
• highly customizable
• possible to create standard, composer ready solution with chance to adjust whitelist thru configuration (eg using https://devdocs.magento.com/guides/v2.4/ext-best-practices/tutorials/dynamic-row-system-config.html to store whitlelist element)

cons:

• developer knowledge required