How would you design and implement a strict Content Security Policy for a complex web application that uses third-party scripts and inline styles?

Imagine your house has a rule that only allows toys from your toy box and not from strangers. Content Security Policy (CSP) is like a rule for websites that tells the browser which things (like scripts and styles) are allowed to run, keeping bad guys from sneaking in dangerous stuff.