Unfortunately, using Google Tag Manager basically requires setting 'unsafe-inline', neutering your CSP.