Content policy security

Question

<script src ="https://apis.google.com/js/platform.js" async defer></script>
        <meta name="google-signin-scope" content="867481794489-tjnf385dfvo0sn9oc50djqrvtutvopur.apps.googleusercontent.com">
        <meta http-equiv="Content-Security-Policy"
              content="default-src *; child-src 'none'; object-src 'none'; unsafe-inline 'sha256-7Cs2mJY7nIdns6q34/edHqQRcRlvbjyozKuE9D5qPYY=' ">