What does 'strict-dynamic' do in script-src 'nonce-abc123' 'strict-dynamic' https:?

With 'strict-dynamic', trust passes on. If a nonced script creates a <script> element and adds it to the page, that script may run too. This is what tag managers and bundler chunk loaders need. Browsers that support it ignore host sources like https: and 'self'. That is why you can keep them in the policy as a fallback for older browsers.

"Any script from an https: URL can run" is the tempting wrong answer. That is only true in old browsers that don't understand 'strict-dynamic'. "It blocks every script added after load" is the opposite of what it does.