The Toolbar loading process adds inline JavaScript and CSS

In toolbar_page_attachments(), there is logic that temporarily adds inline JavaScript within a <script> to the page - and this JavaScript adds CSS in a temporary <style> tag. These additions are provided to facilitate a more graceful loading of the toolbar.

These additions can be manually prevented by implementing hook_page_attachments() and unsetting the 'anti_flicker_js' key from 'html_head'

Sites with a CSP disallowing inline JS or CSS will not experience any regressions if these temporary tags are not permitted. If the script/style tags are not present, the site will not function any differently. When the script/style tags are present, there are visual improvements as toolbar will load with fewer reflows than it did prior to this change. Both tags have the data-toolbar-anti-flicker-loading attribute. Any tags with this attribute are removed from the DOM when the toolbar completes initialization.

Update:
Since Drupal 10.1.3, this JavaScript has been moved to a new toolbar.anti-flicker library which is a dependency of the main toolbar library and will no longer be rendered inline. See: https://www.drupal.org/node/3383056