CSP missing object-src
The policy does not set object-src.
Why it matters
Plugin content would inherit default-src. Modern browsers block most plugins, so this is defense in depth.
What to do
Add object-src 'none'.
Reference
CSP Level 3 defines the directives and source lists this check evaluates.