Our typical approach with security headers with all our Wordpress sites is to use the Security Headers plugin, which allows for modification to CSP (or other headers, as needed).