CSP headers are overflowing when in maintenance mode (throws error 502)

This patch checks if the status code is 503, in case it's true, it will not apply the flags and source directives.

Patch #2 is working on Drupal 9.5.x (PHP 8.1).

Since this sounds like an environment-specific issue (limited to a particular response code), I don't think it's something to be solved within CSP module. There's potential for configuring an alternate policy for circumstances like maintenance mode which could have a much shorter and more restrictive policy, but it would need to be configurable since other people's environments and needed policy will differ.

The patch provided in #2 would omit things from config like 'self', but still allows other modules to alter the policy, which could potentially block necessary assets.

My suggestion would be to implement a custom module with an event subscriber to alter the policy when needed for your environment and the particular response code.