Refuse to load object-src directive of the Content Security Policy

Question

I am trying to load the PDF inside Iframe or embed tag but I am getting blocked plug-in message in safari and an error in the console.