Issue in setting the secured Content Security Policy Headers in Oracle Apex Applications

Oracle Application Express (APEX)

version 23.1

Issue details:

We are trying to implement Content Security Policy in our Apex application (at Apex 23.1) but when we set the content security policy as "default-src 'self';". This block all the in-line script generated by Apex engine internally unless we add 'unsafe-inline' policy (which is not really secure). 

Similarly Apex dynamic actions as well auto generating javascript which rendered in the page html as an inline JavaScript under <script> tag.   Since Apex is internally generating script dynamically, this will be tricky to generate nonce (too many) or hashes to secure the inline script or css.