script-src-elem is always added

Hi,

I've set up my CSP settings and add only script-src und style-src directives.
But if I load a node add form, the following header is responded:

Content-Security-Policy-Report-Only: script-src 'self' 'unsafe-inline' https://maps.googleapis.com https://cdnjs.cloudflare.com https://rebilly.github.io https://unpkg.com platform.instagram.com platform.twitter.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://unpkg.com; script-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com https://unpkg.com

You can see, that there is the script-src-elem directive added. But I have not configured.

My csp.settings are

report-only:
  enable: true
  directives:
    script-src:
      sources:
        - 'https://maps.googleapis.com'
      flags:
        - unsafe-inline
      base: self
    style-src:
      flags:
        - unsafe-inline
      base: self
  reporting:
    plugin: none
enforce:
  enable: false