Yes, CMP V2 supports the use of Content Security Policy (without 'unsafe-eval').
You can use CMP V2 Script Tag using bundle.js instead of loader.js with the below provided base ruleset and it will work fine.
<meta http-equiv="Content-Security-Policy" content="script-src https://*.usercentrics.eu 'self'; connect-src 'self' https://*.usercentrics.eu; img-src 'self' https://*.usercentrics.eu; object-src 'self' https://*.usercentrics.eu;">
If you want to support the legacy browsers, then you can use the bundle_legacy.js.
Please note
But currently, we do not support the use of loader.js with Content Security Policy (without unsafe-eval).