Refused to send form data on password reset with 'self'

If your form's action attribute uses a relative url (action="/user/password") then 'self' should be fine,
but for an absolute URL (action="https://sso.example.com/user/password") the domain of the form target would need match the page's current domain.
(Protocol also matters - submitting from https to http would be blocked as well - but I assume from your description all domains are served via https). 'self' is interpreted by the browser, which has no knowledge of separate sites/domains being served by the same codebase or being otherwise connected.

Allowing just the top-level domain does not allow its subdomains: e.g. adding example.com to your policy will not allow sso.example.com.
It also applies in the other direction: the host pattern *.example.com would not allow the TLD example.com
To allow both the TLD and any of its subdomains (to any depth), you would need to include both example.com and the wildcard host pattern *.example.com in your policy.

https://www.w3.org/TR/CSP3/#match-hosts