If anyone read this and thought, "I should add a Content-Security-Policy to my website," I've written and published an open source tool for building CSP headers programmatically and/or from a JSON configuration file.

https://github.com/paragonie/csp-builder