Is this what needs to be done?
For the script part, you should be able to add the script tag to your theme HTML content or a new theme component.
And I think there’s nothing to do for the CSP part, as per Content-Security-Policy now uses 'strict-dynamic'