I'm also facing this issue and trying to find a solution for it. I don't think the nonce here is the same as Apple's nonce. I'm guessing this Content Security Policy directive is a separate thing that requires it's own nonce, hash, or the keyword unsafe-inline to be added somewhere. I'm continuing to find a solution to this problem with no luck so far.
Note that I'm configuring the authorization object using the JavaScript APIs, not by using markup, and facing the same issue.
html
script type="text/javascript" src="https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js"/script
div id="appleid-signin" data-color="black" data-border="true" data-type="sign in"/div
script type="text/javascript"
AppleID.auth.init({
clientId : '[CLIENT_ID]',
scope : '[SCOPES]',
redirectURI : '[REDIRECT_URI]',
state : '[STATE]',
nonce : '[NONCE]',
usePopup : false
});
/script
I'm also using Google Chrome to test my Sign In with Apple implementation.