CSP is report-only and not enforced
Content-Security-Policy-Report-Only is present and there is no enforcing Content-Security-Policy.
Why it matters
Report-only records violations. It does not block them.
What to do
After you have reviewed reports, publish the same policy as Content-Security-Policy.
Reference
CSP Level 3 defines the directives and source lists this check evaluates.