dashboard_csp(progress_url, stop_url=None)
Hash the exact bundled inline assets and allow only explicit API origins.