Ajax form content security policy
script-src 'unsafe-inline' is required by CKEditor 4 included in Drupal 8 core, so a newer WYSIWYG editor may not require it.  Drupal 9 will hopefully include CKEditor 5, which will not require 'unsafe-inline'.
CSP Level 3 also introduces the script-src-attr and script-src-elem directives, which can be used to allow only scripts in element attributes and not &lt;script&gt; elements, which will enable CKEditor 4 to work and reduce risk.

Drupal 7 also requires inline scripts be allowed for drupalSettings, though there is a patch available.



Hashes and nonces have some downsides and challenges


CSP Level 2 only allows hashes on inline &lt;script&gt; elements, not element attributes like onclick.  CSP Level 3 introduces 'unsafe-hashes' to allow hashes for attributes, but it can't really be used at this time because of a lack of browser support.
CKEditor 4 would require a 1.5KB CSP header for all of the hashes it would require.
Nonces are only applicable to &lt;script&gt; elements.
Nonces must be regenerated on each page load, preventing the page cache or other front-end caches from being able to cache the page.