effectiveDirective vs originalPolicy

The policy adds script-src-attr 'none'. The violation trigger is an inline event handler (onclick). effectiveDirective is "script-src-attr" — different from "script-src-elem". This is an event handler attribute, not a <script> block.