Since the inclusion of #10700 the map tiles are being blocked by default, unless you append to config/initializers/decidim.rb the following setup (e.g. OSM):

  config.content_security_policies_extra = {
    "img-src" => %w(https://*.openstreetmap.org)
  }

At least, that should be referred from https://docs.decidim.org/en/develop/services/maps.html, or including a set of "safe domains" that Decidim uses internally, once the development_app is created