there are several violations reported like this:

gr-app.js:1550 [Report Only] Refused to load the script 'https://chromium-review.googlesource.com/plugins/buildbucket/static/cr-buildbucket-view.html' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:". 'strict-dynamic' is present, so host-based whitelisting is disabled.

importHref @ gr-app.js:1550
chromium-review.googlesource.com/:1 [Report Only] Refused to load the script 'https://chromium-review.googlesource.com/plugins/buildbucket/static/cr-buildbucket-client.html' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:". 'strict-dynamic' is present, so host-based whitelisting is disabled.

chromium-review.googlesource.com/:1 [Report Only] Refused to load the script 'https://chromium-review.googlesource.com/plugins/buildbucket/static/cr-tryjob-picker.html' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:". 'strict-dynamic' is present, so host-based whitelisting is disabled.

chromium-review.googlesource.com/:1 [Report Only] Refused to load the script 'https://chromium-review.googlesource.com/plugins/buildbucket/static/cr-buildbucket-view.js' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:". 'strict-dynamic' is present, so host-based whitelisting is disabled.

chromium-review.googlesource.com/:1 [Report Only] Refused to load the script 'https://apis.google.com/js/platform.js' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:". 'strict-dynamic' is present, so host-based whitelisting is disabled.

chromium-review.googlesource.com/:1 [Report Only] Refused to load the script 'https://chromium-review.googlesource.com/plugins/buildbucket/static/cr-tryjob-picker.js' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:". 'strict-dynamic' is present, so host-based whitelisting is disabled.

chromium-review.googlesource.com/:1 [Report Only] Refused to load the script 'https://chromium-review.googlesource.com/plugins/buildbucket/static/cr-buildbucket-client.js' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:". 'strict-dynamic' is present, so host-based whitelisting is disabled.