fix: CSP user directives now override defaults instead of duplicating

fix: CSP user directives now override defaults instead of duplicating #7165