i'm using express with helmet (https://helmetjs.github.io/#reference) and nextjs app router. the default CSP policy looks like it disallows the scripts that are injected into the page, which seems like it breaks some functionality (i noticed <Link> usage is broken for example. it does a full page refresh instead of clientside reload).

ive found a few threads:
- https://github.com/vercel/next.js/issues/42330
- https://github.com/vercel/next.js/issues/43743
- https://github.com/vercel/next.js/discussions/51039

but nothing really addresses how to handle these inline scripts with a custom server.

is it possible to use app router with a strict CSP policy? i'd rather not set unsafe-inline for these reasons: https://content-security-policy.com/unsafe-inline/