Support for CSP hardening mechanisms (e.g., nonce/hash templates, report-only CSP, or optional flag to enable safe CSP by default)

We’ve noted that the current Content-Security-Policy header in our project alertmanager implementation includes unsafe-inline and unsafe-eval, which conflict with our security policies.

alertmanager-virtualservice.yaml

http:
- route:
- destination:
host: app-alertmanager
port:
number: 9093
headers:
response:
add:
Content-Security-Policy: "script-src 'self' 'unsafe-eval' 'unsafe-inline';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline' blob:;img-src * data:;base-uri 'self';connect-src 'self';manifest-src 'self';media-src 'none';form-action 'self';"
{{- end }}

Unlike Grafana—which supports nonce-based or report-only CSP templates—Alertmanager appears to offer no similar configurations per its documentation and codebase.
The only nonce references appear in Webpack build tooling for the React UI and do not affect runtime headers. Would you consider adding CSP configuration features to remove unsafe directives while keeping the UI functional?

Start with alertmanager-virtualservice.yaml and review the Alertmanager documentation and codebase for existing CSP configuration points. Compare the runtime header with the Webpack build-time nonce references and determine which supported mechanism—nonce or hash templates, report-only mode, or an opt-in safe default—has a testable completion criterion.