There is an ongoing outage on the primary CPAN mirror. It is possible to work around the issue by using MetaCPAN as a mirror.
No distributions depending on HTTP::Promise::Headers::ContentSecurityPolicyReportOnly could be found