Can you check the network tab and see what content-type the scripts are sent as?

This error is also common if the .js-file cannot be loaded. Can you confirm that the files are present? If not ensure that the modules are properly installed in your solution.

I have confirmed that the files are available; they have content beginning with define(...). The content type of these files is application/json.

I would have guessed app.UseStaticFiles would have set the correct MIME Types but you could try adding yourself 

var provider = new FileExtensionContentTypeProvider();
provider.Mappings[".js"] = "application/javascript";
app.UseStaticFiles(new StaticFileOptions { ContentTypeProvider = provider });

I've just tried to replicate this locally on 12.17.1 and could not replicate 

• Install Alloy
• Upgrade to 12.17.1
• Add security header 

        app.Use(async (context, next) =>
        {
            context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
            await next();
        });

I also tried with using the deny option and still worked here is the content type you asked for 

We have also encountered this issue yesterday and it seems that ExtendedNewtonsoftJsonOutputFormatter is the problem.

I've used the Foundation project to check what is the difference compared to our project and it turned out that it uses ExtendedSystemTextJsonOutputFormatter which properly assigns content type for these resources based on ResponseDecorator.

Most likely, Alloy uses the same formatter thus you were not able to reproduce this issue there.