You will have to tweak your external JS, load the other referenced JS files also as static resources and include them in aura component using ltng:require.
Refer to CSP Overview
JavaScript libraries can only be referenced from your org. All external JavaScript libraries must be uploaded to your org as static resources. The script-src 'self' directive requires script source be called from the same origin.
SF objective here is to help prevent cross-site scripting (XSS) and other code injection attacks
Your external JS file is trying to create a script tag and add it dynamically to window.document.head. During page rendering, element.setAttribute('src', hostedJsPath + '/apty-client.js'); will possibly translate into script-src tag at page level. Adding the URL to CSP will not allow you to fiddle with script-src tag and that will always be set to self by default. As mentioned in CSP Trusted Sites access to 3rd Party APIs, only the few other tags are supported.
When you define a CSP Trusted Site, you can add the site’s URL to the list of allowed sites for the following directives in the CSP header.
connect-src, frame-src, img-src, style-src, font-src, media-src
For understanding the differences between connect-srcconnect-src & script-srcscript-src, you may refer this & this.