Magento 2.3.5 Content Security Policy (CSP) data:image

In your custom csp_whitelist.xml (eg. in a custom modules etc-directory) add this:

<policy id="img-src">
  <values>
    <value id="data" type="host">data:</value>
  </values>
</policy>

The colon as suffix is the important stuff here.