Describe what change you would like :
I propose the removal of lines 46 and 47 since all of the options are unsafe:

• unsafe-inline is obviously counter-productive, as it is correctly said at line 47.
• unsafe-eval allows eval.
• https: allows ALL scripts using HTTPS to be executed.

Context :
Section: 12-appendices/01-implementation-dos-donts/05-content-security-policy

Accessible on: https://devguide.owasp.org/en/12-appendices/01-implementation-dos-donts/05-content-security-policy/