How do I configure Content Security Policy for base64 images? I'm using the Content Security Policy module and I placed restrictions on img-src.
Set to Self.
Additional sources:
https://www.google-analytics.com https://ssl.gstatic.com https://www.gstatic.com https://www.googletagmanager.com

However, my logs are filled with messages like this:

[Report Only] Refused to load the image
'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAICAYAAADED76LAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAD1JREFUeNpiYGBgOADE%2F3Hgw0DM4IRHgSsDFOzFInmMAQnY49ONzZRjDFiADT7dMLALiE8y4AGW6LoBAgwAuIkf%2F%2FB7O9sAAAAASUVORK5CYII%3D'
because it violates the following Content Security Policy directive:
&quot;img-src 'self' https://www.google-analytics.com
https://ssl.gstatic.com https://www.gstatic.com
https://www.googletagmanager.com&quot;.

How do I allow the base64 images provided by Drupal (jsonapi in this case)?
Based on this Stack Overflow answer, you need to add data: to Additional Sources:
data: https://www.google-analytics.com https://ssl.gstatic.com https://www.gstatic.com https://www.googletagmanager.com