"You can ignore all empty inline styles"
I cannot ignore the empty inline styles. If the style attribute is present, then the inline style CSP rule still applies. I would remove them but I can't determine where they are coming from - it's probably buried in javascript somewhere? I've seen it in DataTables if that is helpful.
"Is there any non-empty inline style that affects your reports?"
Probably. If you are looking to correct the problem one inline style at a time, we could be doing a back-and-forth for a very long time. It depends on how the koolreport library was written. How many inline styles are there?
Typically in the inline style case, you would move the styles to a css file (as classes) and change the code from inline styles to class references. You would know better if this is reasonable. There are other approaches too.
And this is just addressing one CSP rule - XSS is the important one (addressing scripts).
At this point, I am looking for more of an approach and answering some bigger questions...
Is it feasible to use koolreport with a CSP?
if yes, what is recommended? how should we configure our CSP? Should we be disable rules (and possibly expose vulnerabilities)?
have others done this too? what are "best practices"?
If I am too vague, this article does a really good job of capturing the scope - including the section "Writing JavaScript and CSS with CSP in Mind"...
https://www.invicti.com/blog/web-security/content-security-policy/