Javascript 内容安全策略脚本无法运行，被错误阻止

编辑：这已经发布了一整天了。希望有人能提供建议

编辑2：仍未解决

所以我正在做一个独立的项目，但是谷歌chrome扩展的前提基本上是点击一个按钮，运行一个脚本。该脚本包含一个必须打开才能运行的链接，我无法确定如何在要运行的脚本中白名单该链接。这是我的manifest.json代码

{
"name": "mybotnotyourbot",
"version": "1.0",
"description": "stoptryingottakemybot",
"options_page": "options.html",
"permissions": ["activeTab", "declarativeContent", "storage"],

"content_security_policy": "'default-src' 'self' 'https://www.supremenewyork.com/shop.js'",
"background": {
  "scripts": ["background.js"],
  "persistent": false
},
"page_action":
{
  "default_popup": "popup.html",
    "default_icon":
    {
        "16": "images/get_started16.png",
        "32": "images/get_started32.png",
        "48": "images/get_started48.png",
        "128": "images/get_started128.png"
    }
},
"icons": {
  "16": "images/get_started16.png",
  "32": "images/get_started32.png",
  "48": "images/get_started48.png",
  "128": "images/get_started128.png"
},

"manifest_version": 2

}

大多数情况下，一切都是现在只是被用作模板概述该项目，我得到的错误代码是这些

CSP directive 'script-src' must be specified (either explicitly, or implicitly via 'default-src') and must whitelist only secure resources.
CSP directive 'object-src' must be specified (either explicitly, or implicitly via 'default-src') and must whitelist only secure resources.

这些错误没有意义，因为我使用的所有链接都包含https

Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'self' https://www.supremenewyork.com/shop". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution.

我相信这是因为https

再说一次，我对HTML和JSON非常陌生，请不要太苛刻！如有任何见解，将不胜感激：）

ps：脚本是用js编写的