I was expecting that upon a package installation when deploying a scratch org that the Remote site settings and/or CSP trusted sites would be deployed, however, this does not seem to be the case. The sites are added, however, don't seem to be active and I have to manually activate them. Currently, my workaround is to actually include the remoteSiteSettings and cspTrustedSites alongside their corresponding metadata, however, in the scratch org, I find myself with duplicate metadata (the settings i deploy being active, and the ones installed from the package inactive) Normally, if I would install the package in any org, the site settings would be deployed and active after a successful package installation.
Is this the expected behavior when deploying managed packages in scratch orgs? if so, is there any other way of ensuring that CSP and remote site settings are deployed and active without having to add them in the metadata or activating manually?