Yes, your code is being blocked by CSP. (see security settings)
You could whitelist unsafe-inline in the settings, but that doesn’t sound like a good idea.
In your case, to make your code work with CSP enabled, i believe you need to handle the click differently.
On a side note, here is a theme component using your code: https://github.com/Arkshine/discourse-timer-component.
Feel free to fork it and install it on your Discourse.
Hopefully, my code is not too horrible, but this would be the preferred way as opposition adding plain JavaScript in this context.
It should work the same with extra reactivity stuff, settings, and locale.
It may be overwhelming, but it is an excellent opportunity to dig into theme component development! Do not hesitate to ask if you don’t understand something. 
I highly recommend using the Discourse Theme CLI if you want to work with it locally. It’s handy!