What is a Content-Security-Policy?
Without a Content-Security-Policy, a browser loads everything in your HTML, including scripts and images from outside. A policy lets you decide what may load, and from where.
An external script runs along
Put a script from another party on your page and it runs with the same rights as your own code. It can read what a visitor types, see what is on the page, or redirect the visitor. If that party is hacked, or means harm, it happens on your page, to your visitors.
An image leaks something too
It need not even be code. To fetch an image from an external party, the browser sends that party a request. The request carries your visitor's IP address and the page they are on. So that party learns who visits your site, with nothing visible happening.
A policy draws the line
With a policy you name the sources that may load. The browser holds to it and blocks the rest. That way you decide who runs along on your page, instead of every embedded party.
How to set one
Turning on a strict policy at once can break your page, so you roll it out in steps. How that goes differs per platform: