Coding guideline JS1 (https://wiki.koha-community.org/wiki/Coding_Guidelines#JS1:_Embedding_JavaScript_blocks_in_templates) says "Whenever possible JavaScript should be placed in a separate file." I propose to move most of the JS embedded in reports/guided_reports_start.tt to a separate file.
I didn't realize that we had a coding guideline for this. That's awesome. I'd really like us to make more of an effort on this one to enable Content-Security-Policy going forward.