CSP missing frame-ancestors
The policy does not set frame-ancestors.
Why it matters
Clickjacking protection then depends only on X-Frame-Options, which newer embedding rules do not use.
What to do
Add frame-ancestors 'none' or 'self'.
Reference
CSP Level 3 defines the directives and source lists this check evaluates.