Thank you for this Kitten! 🙏

Loading discographies3.js while viewing https://www.wikidata.org/wiki/Q17544624 results in the following CSP errors in my browser's console:
Loading the stylesheet 'https://cdn.datatables.net/1.12.1/css/jquery.dataTables.css' violates the following Content Security Policy directive: [...]
Loading the script 'https://cdn.datatables.net/1.12.1/js/jquery.dataTables.js' violates the following Content Security Policy directive: [...]

Is that the same library as available on the Toolforge CDNjs mirror? Not the same version, most recent there is 1.10.21, but perhaps that helps?

https://tools-static.wmflabs.org/cdnjs/ajax/libs/datatables/1.10.21/js/dataTables.jqueryui.js

Although I see now T419318: Loading scripts or stylesheets from https://tools-static.wmflabs.org/cdnjs/ generates CSP warning 🤔

In T419559#11696003, @JeanFred wrote:

Is that the same library as available on the Toolforge CDNjs mirror? Not the same version, most recent there is 1.10.21, but perhaps that helps?

I wouldn't personally be sure, to be honest - I'm not familiar with the script myself, so I wouldn't know whether or not using that version on the Toolforge mirror would make a difference. (Also, it seems like it'd probably need a Wikidata intadmin to make such a change, as FWICS @Lectrician1 hasn't been active for a few months).

We are generally trying to unbreak things, but this is a pretty heavy set of domains. Could someone provide a little rationale for why all of these domains need to be pulled in live client-side?

I don't use this userscript, so I will defer in large part to those that do (e.g. @Moebeus). However, IIUC, embeds.js pulls in such a large set of domains precisely because its purpose seems to be to display embedded frames for a wide variety of external platforms.
E.g., temporarily disabling CSP locally & loading the script while viewing Taylor Swift's Wikidata item results in at least the following embedded frames being added for Amazon Music/SoundCloud/Spotify/Deezer/TikTok:

(As a side-note, it seems like some of these frames pull in external resources from other, additional domains. So it might be that just allowlisting the ones listed in the description may not be enough to fully unbreak embeds.js. I don't know what the solution is here, but I'm saying this as it feels important to point out the possible disruption that may be being caused by the recent start of CSP enforcement, especially as it doesn't currently seem like there's necessarily a good solution for this sort of userscript. :/)

Maybe it might help splitting up these two? The more important one by far is really the discographies3.js script.
I understand the embedding script might be less feasible given the nature of what it does and all the whitelisting required.