The original poster is correct, this needs to be handled by Hubspot. The frame-ancestors content security policy setting is on Hubspot’s side to change. In Hubspot’s CSP for `https://app.hubspot.com/\` frame-ancestors is set to ‘self’. This means that `https://app.hubspot.com` is only allowed to be loaded on app.hubspot.com itself and not in an iframe on any other domains.
However, when you use the form embed code it tries to load `https://app.hubspot.com/forms-next-v2-captcha` as part of the payload. So this either needs to be moved to another domain that is allowed to be embedded in iframes or remove the frame-ancestors directive from the app.hubspot.com CSP.