LOL yeah I was able to reproduce this issue. I checked the root .htaccess file physically on my test site and see the ASCII characters. So yep the htmlspecialchars_decode function is converted single quotes. I will need to look at this further to decide what the best approach would be for this issue. For now you will have to add any code with single quotes in it directly into your .htaccess file and cannot use Custom Code for this code.
Header set X-Content-Security-Policy “default-src 'self'; img-src 'self' analytics.mydomain.com; \
script-src 'self' analytics.mydomain.com ajax.googleapis.com; font-src 'self' data:” env=ie