The problem is that you use a script attribute with an inline event handler 'onload="test()3"' (or 'onload="test3()"'). Script attributes are not nonceable elements. You should add this with an event listeners instead, or add its hash and 'unsafe-hashes' to script-src.