This new change to Jenkins came as a complete surprise, and stopped virtually all JavaScript and some inline CSS from working. I've worked around it for the moment; I need to learn the full details and put a more refined policy in place when I understand it better.