Should Content-Security-Policy header be applied to all resources?

Is it necessary to apply the Content-Security-Policy Header to all resources on your domain (images/CSS/JavaScript) or just web pages?

For example, I noticed that https://content-security-policy.com/images/csp-book-cover-sm.png has a CSP header.

Most of the directives of CSP are only relevant to web pages that are rendered in a browser, as CSP controls the allowed sources for content of such pages. You will typically only need to set it on non-redirect responses with content type as "text/html" but it could also apply to edge cases such as SVG files including script.

The frame-ancestors directive can however be relevant for all file types that can be displayed in the browser in an iframe, such as images, media, pdf, etc.

As it is often simpler or only possible to just add a response header to all responses, CSPs are often applied to all content types and codes even though they are not strictly needed. Additionally it is recommended to add a CSP with a strict frame-ancestors to REST APIs to prevent drag-and-drop style clickjacking attacks, see https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html#security-headers.