So... don't bother using CSP. You've just allowed all the bad guys in anyway.
If you change that construct to
content-security-policy: script-src https://test1dummy.com/ https://www.google.com/ 'self' https://test2dummy/ https://test3dummy
then you've restricted scripts to run from code files on the site itself, plus any of the whitelisted URLS.
is valid, because test1dummy.com is whitelisted.
is valid - but only if mydomain.com is the domain that the CSP headers are running on. If not, then that won't be valid.
This would NOT be valid, now that we've removed the inline-unsafe option.
If we have a script which is running on a whitelisted domain, such as
and that script itself ends up modifying the DOM and injecting inline script, then that will also be caught by your construct and blocked. And so on, ad-infinitum. Tracking down the script that adds the inline JS is a lot of fun with CSP headers. In the same way, if you leave the 'unsafe-inline' option in place, any of your whitelisted domains can add inline code to your page.