CSP Violation: "blocked-uri": "inline" despite having 'unsafe-inline'

I've just recently started working with the Content-Security-Policy header for my apache/joomla/fedora35 install on a pretty complex website and having some problems.

I have the following log entry for my CSP header that shows a javascript resource from my website was blocked by the style-src-elem directive, but I've set both the default-src and style-src-elem directives to allow 'unsafe-inline' scripts. Is that not enough?

Also, it appears quite a few directives require common sites like googleapis and facebook - is there a way to just set them all by default? Will the default-src directive set the default for all directives?

    "csp-report": {
        "document-uri": "https://example.com/features/complete-guide-to-keylogging",
        "referrer": "https://www.google.com/",
        "violated-directive": "style-src-elem",
        "effective-directive": "style-src-elem",
        "original-policy": "default-src 'self' 'unsafe-inline'; font-src 'self' fonts.googleapis.com fonts.gstatic.com data:; img-src data: 'self' *.clarity.ms *.googleusercontent.com www.google-analytics.com *.google.com google.com; object-src 'none'; style-src 'self' 'unsafe-inline' fonts.googleapis.com; frame-ancestors 'none'; style-src-elem 'self' fonts.googleapis.com; script-src code.jquery.com *.googlesyndication.com *.facebook.net; script-src-elem 'unsafe-inline' 'self' example.com *.googletagmanager.com; script-src-attr 'self' 'unsafe-inline'; report-uri /csp-hotline.php",
        "disposition": "enforce",
        "blocked-uri": "inline",
        "line-number": 2,
        "column-number": 54854,
        "source-file": "https://example.com/media/jui/js/jquery.min.js",
        "status-code": 200,
        "script-sample": ""
}

Where do I find line-number 2? Is it just the second line from the top of the source we can see just by going to the page and pressing F12?

I've also reviewed this post from many years ago from someone having effectively the same problem, but also believed it may be a bug with the report-uri directive/function. Is it possible that's what we're seeing here too? Why is this a CSP violation? blocked-uri = self when 'self' is explicitly allowed