CSP missing base-uri
The policy does not set base-uri.
Why it matters
An injected <base> tag can retarget relative URLs, including script and form addresses.
What to do
Add base-uri 'self' or 'none'.
Reference
CSP Level 3 defines the directives and source lists this check evaluates.