I've been working on this very challenge today (although I dont have any forms in my portal), but I was able to achieve some level of success by allowing inline styles for specific domains (I know this isnt the solution you are asking for, but is as close as I could get).
The MS doco is here https://learn.microsoft.com/en-us/power-apps/maker/portals/configure/manage-content-security-policy
And I ended up with the following CSP for my Starter Portal (which uses Azure B2C, application insights and the PWA mobile app setting):
script-src 'self' 'unsafe-inline' content.powerapps.com 'nonce' js.monitor.azure.com storage.googleapis.com; style-src 'self' 'unsafe-inline' content.powerapps.com 'unsafe-inline'; img-src 'self'; connect-src 'self' js.monitor.azure.com content.powerapps.com storage.googleapis.com australiaeast-1.in.applicationinsights.azure.com; font-src 'self' content.powerapps.com static2.sharepointonline.com; prefetch-src js.monitor.azure.com;
I determined which domains to include while building my CSP by reading the javascript console errors visible in the chrome developer tools javascript console.
The 'unsafe-inline' in the segment below is what allowed my own and the MS inline styling to work (by permitting inline styling for the specified domains, even though CSP recommends you dont do this)
style-src 'self' 'unsafe-inline' content.powerapps.com 'unsafe-inline';
Hope this helps someone, and agree it would be nice if OOB was CSP compliant.
