Tagging @lognaturel, since I think she reviewed the original CSP.

Changed the base to next. @alxndrsn could you please keep the PR checklist that has a reminder about target branch?

We need * for arbitrary images embedded in markdown descriptions and data for the QR codes.

I think it would be helpful to add this as a comment, but commenting every one of these rules would get out of hand quite quickly 🤔

I think what you've done with the commit message is great! If we have questions we can use git to see what was going on.

I always try to leave a note of what I think about when I do a review also for archaeology purposes.