[Bug] DocFX generated HTML fails Content Security Policy about docfx

[filzrev]

It seems CSP errors can be suppressed by explicitly setting hash-source value as noted on reported error message.
(Except for style="" attributes. that is fixed by #10020)

Example CSP error message and how to fix error

index.html:35 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-EqCpmPzzL1OBCKRrI480jhMLWMTYbVQgeZZftbEm4yE='), or a nonce ('nonce-...') is required to enable inline execution.

It need to add 'sha256-EqCpmPzzL1OBCKRrI480jhMLWMTYbVQgeZZftbEm4yE=' hash to script-src section.

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' https://fonts.googleapis.com". Either the 'unsafe-inline' keyword, a hash ('sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='), or a nonce ('nonce-...') is required to enable inline execution.

It need to add 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' hash to style-src section.

---

I've confirmed reported CSP errors can be fixed by adding above settings (and PR #10020)
But when using mermaid.js or Math Expression
Additional CSP errors occurs and needs additional settings.