So when security reviewed Flicks, they said that adding this to CSP basically invalidated the entire reason of having CSP in the first place.

I think that this is fine if betafarm needs GA immediately, but if it doesn't, or in the long term, we need to put the GA code in an external JS file. There's been some fear about how finicky GA will be in an external JS file and how the docs say to use an inline script tag, but I can't see anything in the JS that wouldn't work in an external file.