Add to connect-src: analytics.google.com, www.google.com,
www.googletagmanager.com — required for GA event beacons and
Google Ads conversion/remarketing collect endpoints.
Add to script-src: googleads.g.doubleclick.net — required for
Google Ads conversion tag script injection via GTM.