How to set content-security-policy header?
I may be a bit biased in thinking that the Content Security Policy module is the best solution for adding a policy to your site, but here are some of the reasons for using the module:


Integration with the Libraries API to automatically generate script and style directives
An admin interface that validates your policy configuration
Provides a reporting endpoint to receive policy violations and add them to your site log, so you don't need to use an external service like Report-URI.com (but it also provides a plugin to use it, if you do).
The Reporting API module is still in beta, but it will have improvements over CSP's reporting handler, and has a plugin to integrate with CSP module.
Some optimizations to shorten your policy where possible (e.g. If a fetch directive like img-src that falls back to default-src has the same value, it is omitted)
In the future modules will be able to integrate with CSP module to alter the policy as needed (enabling additional directives, altering the policy per-page)




There are a couple alternatives to the CSP module, if you don't want all of these additional features:


The Security Kit module allows adding a CSP policy header, but it only allows either an enforced or report-only policy, and it does not have fields for many newer directives.
The HTTP Response Headers module allows you to configure a static value for any HTTP header you want
Set a static header in your own response event subscriber in a custom module.
You can set the header directly in Apache or nginx configuration