Last time I looked Google position was: "Regarding which headers will be allowed, we'll look at the feedback from devs and the current metrics and decide. In general, we want to take a closer look at the security implications of header modification."

tldr: CSP modification was strictly forbidden. Digging in further it seems this changed somewhere in 2020 and appears to be working now https://bugs.chromium.org/p/chromium/issues/detail?id=111648...