Not entirely sure how I ought to write tests for this...
I only manual tested with <meta http-equiv="Content-Security-Policy" content="script-src 'self'" /> in the index.html file

Not entirely sure how I ought to write tests for this...

Yep, that sounds pretty complicated. This might require some research, but I think we cannot test this through our unit tests (jest, pytest) since there isn't any browser involved. So, we either have to test it via e2e tests by adding it somehow to the index.html (injecting it via javascript would not work) or we have to add the CSP header as default to Streamlit. Maybe adding the CSP header to Streamlit core is even requested by the SIS/Security team, not sure.

One super hacky way I can think of would be the following: inject the header into the index.html file (see this for an example) from the python e2e script. This might also require to force one rerun (e.g. via experimental_rerun) to have the cypress browser load the modified file. And we might need to clean the index.html file up again for the following tests.

Another cleaner solution might be that we add an optional config option (e.g. server.enableCSPProtection) that - if activated - adds the CSP to the HTTP headers of the webserver (similar to how it is done here). Maybe that is even a valid feature to officially add to our config options.