Apply content-security-policy to the HTML options page. This is a

chrome/browser/resources/shared/js/options/sync_setup_overlay.js

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 cr.define('options', function() {
   const OptionsPage = options.OptionsPage;
 
   // Variable to track if a captcha challenge was issued. If this gets set to
   // true, it stays that way until we are told about successful login from
   // the browser.  This means subsequent errors (like invalid password) are
@@ skipping 640 matching lines @@
 
   SyncSetupOverlay.showSuccessAndSettingUp = function() {
     SyncSetupOverlay.getInstance().showSuccessAndSettingUp_();
   };
 
   // Export
   return {
     SyncSetupOverlay: SyncSetupOverlay
   };
 });