remove https://fdroid.gitlab.io from Content Security Policy
Years ago, we had to do a deploy hack to support the badges, so they came from fdroid.gitlab.io. That is no longer necessary, and !870 (merged) removed that hack, so badges come straight from f-droid.org now:
Removing the fdroid.gitlab.io simplifies and tightens up the security policy for f-droid.org. @Pander are the badges still working as expected?