Culprit:
AbstractFolder/configure.jelly#L78

Reproduction steps:

• Install Folders or clone https://github.com/jenkinsci/cloudbees-folder-plugin and then mvn hpi:run
• Create a folder
• Add a value to the "Display Name" field
• Click anywhere on the page
• It should send a POST request using your displayName as a parameter

Screenshot attached about where the feature is displayed.

Proposal
https://www.jenkins.io/doc/developer/security/csp/#legacy-javascript-checkurl-validation

Testing notes

• Ensure to reproduce the feature before any change
• Ensure that you reproduce the feature after you have made the change