GTM support isn’t a plugin, it’s a setting in core Discourse. There’s currently a note about CSP in the setting description.
But I’m guessing you’re thinking of the ad plugin, which is another story. It includes multiple ad options, all of them disabled when you install the plugin. Each setting should probably have a note about CSP so people know about it.