T419265: CSP adjustments related to the 2026 user javascript incident added a number of domains to CSP allowlist. However:

• It is not scalable: if we add 1000 domains we need ~30-100 KB in each web request.
• Most of domains have very niche use, only used in some certain gadget/site/page
• Many of entries may be over broad (allowing entire jsdelivr effectively allow any js from npm be loaded)
• Managing it needs to modify Wikimedia Puppet configuration
• This does not prevent non-WMF resource be loaded in site default JSes (e.g. common.js) or default gadgets - which is a privacy concern.

So it should be better to tie CSP allowlist entries to specific gadgets. When a page is loaded we find all gadget used and combine their CSP with $wgCSPHeader, and send it after deduplication.

• A gadget may dynamically load other gadgets, and this can not change CSP already applied. So CSP should be defined in a "master" gadget that is directly served.
• Of course other than gadgets there are also other user scripts. Solutions of that may be: (1) turn that into gadget (T419692, T36958); (2) create a empty gadget to populate the CSP records; (3) allow user to add individual allowlist domains (T208188).