The module's subscriber to ResponseEvent also applies directives according to the values in settings and from all of the libraries available. This could be separated out to it's own subscribers with a high priority.
Create a new SettingsCspSubscriber, with a high priority, that appends values to directives based on configuration.
Create a new LibrariesCspSubscriber, with a not as high priority, that appends values parsed from libraries.
Other modules with non-default priorities for their subscriber may need to adjust their priority to maintain the desired order.
Fixed
2.0
Code
Automatically closed - issue fixed for 2 weeks with no activity.