Magnifier.js | Javascript library enabling magnifying glass effect | Computer Vision library

My question is similar to, but not the same as:

Content Security Policy (CSP) Header: Onto each file or only the actual HTML pages?

but I don't think there's a clear answer there.

When a web page is loaded, is the Content Security Policy (CSP) for that page (and any resources loaded by that page) defined by the first CSP header encountered, or can it be amended by subsequent resources loaded by that page?

Example

Suppose the webpage at location https://www.example.com/main.html returns a CSP header