Here's my config:
<IfModule headers_module>
Header set Content-Security-Policy “default-src 'self'; img-src 'self' https: data:; script-src 'nonce-%{CSP_NONCE}' 'unsafe-eval'; style-src 'nonce-%{CSP_NONCE}'; style-src-attr 'unsafe-inline'; style-src-elem 'self';”
</IfModule>
I get a syntax error from Apache. It doesn't like the % sign.
I also tried with $ instead of %. No syntax error, but ${CSP_NONCE} is not replaced by a nonce.