i have disabled CSP on everything under /episerver and /Modules :(

but i still have the problem of the quicknavigator that contains the following javascript: href="javascript:void(0)" :(

i am not sure what to do about that

If you set up the CSP headers in a globally assigned ActionFilterAttribute, you can interrogate the ActionExecutingContext to determine if the request is a controller for a PageData object and whether it is a child request or not.

In the example below: all PageControllers have a currentContent parameter for the PageData Object. Block Controllers will always render with filterContext.IsChildAction being true.  I check both values to ensure the CSP headers are only applied on content pages.

    public class ContentSecurityPolicyActionFilterAttribute : ActionFilterAttribute, IActionFilter
    {
        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            base.OnActionExecuting(filterContext);

            if (filterContext.ActionParameters.Keys.Contains("currentContent") && !filterContext.IsChildAction)
            {
                var globalSettings = ServiceLocator.Current.GetInstance<GlobalSettings>();

                if (!string.IsNullOrWhiteSpace(globalSettings?.ContentSecurityPolicy))
                {
                    var csp = globalSettings.ContentSecurityPolicy;
                    filterContext.HttpContext.Response.Headers.Add("Content-Security-Policy", csp);
                }
            }
        }
    }