The problem with a whitelist is that tracking and malicious websites would just move their scripts to these CDNs.

It would certainly break compatibility with some websites, but so did removing flash or silverlight support, or introducing popup blockers before that. And with http2, scripts hosted on third party CDN are bound to disappear.