script-src: 'unsafe-eval' is required in Content-Security-Policy for API list to work

## Bug description

When using the portal, script-src: 'unsafe-eval' is required in a content-security-policy header, or the API Listing feature does not work.

## Reproduction steps

Use portal with a Content-Security-Policy Header containing 'unsafe-eval'
Go to API listing page
Listing is empty with 'no apis'.

## Expected behavior

Working Portal

## Is self-hosted portal?

Yes

## Release tag or commit SHA (if using self-hosted version)
2.33

## API Management service name

[e.g., contoso-api]

## Environment

- Linux (ubuntu 24.04)

## Additional context

Add any other context about the problem here, including screenshots.