Content security policy mismatch
### Node Version

22.13.1

### NPM/Yarn/PNPM Version

NPM 10.9.2

### Strapi Version

5.9.0

### Operating System

Docker/Podman/LXC

### Database

MariaDB

### Javascript or Typescript

Javascript

### Reproduction URL

_No response_

### Bug Description

The responded CSP does not match the configured ones.

I have tried removing `unsafe-inline` from `style-src` and the admin panel UI breaks.
So I should be modifying the correct file.

Reference:
https://docs.strapi.io/dev-docs/configurations/middlewares#security

### Steps to Reproduce

1. Config CSP in `middlewares.js`
2. Reload Strapi
3. Refresh Strapi admin panel
4. Check the CSP header on Chrome developer tools

### Expected Behavior

The responded CPS headers match exactly the configured ones

### Logs

```shell
Copied CSP

default-src 'self';base-uri 'self';connect-src 'self' ws: 'self' http: https: ws:;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';frame-src 'self';img-src 'self' data: blob: market-assets.strapi.io o2o-r2-dev.dtwhk.com;media-src 'self' data: blob: market-assets.strapi.io o2o-r2-dev.dtwhk.com;object-src 'none';script-src 'self' 'self' 'unsafe-inline';script-src-attr 'none';style-src 'self' 'unsafe-inline';upgrade-insecure-requests
```

### Code Snippets

`middlewares.js`
```
let cors;
if (process.env.NODE_ENV !== 'production') {
  cors = {
    name: 'strapi::cors',
    config: {
      origin: '*',
    },
  };
} else {
  cors = {
    name: 'strapi::cors',
    config: {
      origin: process.env.PUBLIC_URL ? [process.env.PUBLIC_URL] : [],
    },
  };
}

const compression = {
  name: 'strapi::compression',
  config: {
    br: true,
    gzip: true,
  },
};

module.exports = ({ env }) => {
  const R2_PUBLIC_ACCESS_URL = env("R2_PUBLIC_ACCESS_URL") ? env("R2_PUBLIC_ACCESS_URL").replace(/^https?:\/\//, "") : null;

  return [
    'strapi::logger',
    'strapi::errors',
    {
      name: "strapi::security",
      config: {
        contentSecurityPolicy: {
          useDefaults: false,
          directives: {
            "default-src": ["'self'"],
            "base-uri": ["'self'"],
            "connect-src": [
              "'self'",
              "ws:",
            ],
            "font-src": ["'self'", "https:", "data:"],
            "form-action": ["'self'"],
            "frame-ancestors": ["'self'"],
            "frame-src": [
              "'self'",
            ],
            "img-src": [
              "'self'",
              "data:",
              "blob:",
              "market-assets.strapi.io",
            ].concat(
              R2_PUBLIC_ACCESS_URL ? [R2_PUBLIC_ACCESS_URL] : []
            ),
            "media-src": [
              "'self'",
              "data:",
              "blob:",
              "market-assets.strapi.io",
            ].concat(
              R2_PUBLIC_ACCESS_URL ? [R2_PUBLIC_ACCESS_URL] : []
            ),
            "object-src": ["'none'"],
            "script-src": [
              "'self'",
            ],
            "script-src-attr": ["'none'"],
            "style-src": [
              "'self'",
              "'unsafe-inline'",
            ],
            upgradeInsecureRequests: [],
          },
        },
      },
    },
    cors,
    'strapi::query',
    'strapi::body',
    'strapi::session',
    'strapi::favicon',
    'strapi::public',
    compression,
  ];
};
```

### Media

![Image](https://github.com/user-attachments/assets/4cb43860-ff15-493e-9183-3223469f2ab4)

https://developer.mozilla.org/en-US/observatory
![Image](https://github.com/user-attachments/assets/a50c3bba-1fbb-483a-a8b7-75588701721c)

### Additional information

_No response_

### Confirmation Checklist

- [x] I have checked the existing [issues](https://github.com/strapi/strapi/issues) for duplicates.
- [x] I agree to follow this project's [Code of Conduct](https://github.com/strapi/strapi/blob/develop/CODE_OF_CONDUCT.md).