Three directives, combined into one header value
default-src 'self', script-src 'self', and style-src 'self' 'unsafe-inline' combine into: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'.
default-src acts as the fallback for any resource type not covered by a more specific directive -- script-src and style-src here override that fallback specifically for scripts and stylesheets, which is why all three are listed even though default-src alone would otherwise apply to everything.
'unsafe-inline' on style-src is a meaningful trade-off, not a default best practice -- it permits inline