Error in Content Security Policy and gtag.js

I see. It looks like you’re running into an old bug we had, which was fixed back in January:

FIX: Do not include URL query in auto-generated CSP header (#11673) · discourse/discourse@b008836 · GitHub

This fix hasn’t been backported to the stable branch, so I’m afraid you’ll either have to update to tests-passed, or wait for the next stable release. In the meantime, the warning you see can be safely ignored - the browser will automatically remove the query component of the URL.