Before Spring '19 we were relying on a Visualforce page included in an iframe inside a Lightning community to load static HTML content. That worked without any issue. It still does when the community is viewed in its published form.
But when we try to do the same thing inside the community builder preview mode, or even within the preview in new tab, we get CSP errors blocking content loading because of the difference in domains from the builder preview and the community.
For example, my published community URL is : (it's a scratch org) https://sandbox-nosoftware-platform-8735-dev-168e27667a4.cs64.force.com/s/
But while viewing the community preview from the builder it is: https://nosoftware-platform-8735-dev-ed.preview.salesforce-communities.com/s/
Notice the different domains? This causes the url of the visualforce page to be blocked by the default community CSP settings because the visualforce page is served from the first URL inside the second URL.
Am I doing anything wrong or are the CSP rules a bit too strict to be blocking your own Salesforce domain?