What does it mean to set a Content Security Policy on response to a non-HTML request?

Question

I understand that I might set a CSP header for the main page of my site, say https://example.com, to restrict from where I can load scripts and other resources. But

Answer 1

The current CSP spec (version 2) says (emphasis mine):

3.6. Policy applicability

Policies are associated with an protected resource, and enforced or monitored for that resource. If a resource does not create a new execution context (for example, when including a script, image, or stylesheet into a document), then any policies delivered with that resource are discarded without effect. Its execution is subject to the policy or policies of the including context.

CSPs only apply to resources that create a new execution context (i.e., a Web page), which includes only top-level documents, embedded objects like