Way to replace HTTP header being applied by APM portals

The CSP header value is actually coming from APM, so there's no local response event that can catch that. The best option would be to put a VIP targeting solution in front of your APM VIP. The external VIP would be able to see and manipulate the internal APM's responses. You'd put your client SSL handling on the external VIP and the internal APM VIP would listen on HTTP. Here's what that external iRule might look like:

when CLIENT_ACCEPTED {
    virtual internal-vip
}
when HTTP_RESPONSE {
    if { [HTTP::header exists Content-Security-Policy] } {
        HTTP::header replace Content-Security-Policy [string map {";" " connect-src *;"} [HTTP::header Content-Security-Policy]]
    }
}