Covered by BOTH "/*" (strict) and "/merge/*" (loose). The served CSP header shows how Cloudflare combines them.