inline javascript may cause an error if the content policy restricts it

so I think a blank href may be the best option.

In Chrome I got:

<blockquote>Refused to execute JavaScript URL because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.
<blockquote>