Nice list. You might want to consider setting a "Referrer-Policy"[1] for sites with URLs that you'd prefer not to leak.
Also, for "Set-Cookie", the relatively new "SameSite"[2] directive would be a good addition for most sites.
Oh, and for CSP, check Google's evaluator out[3].
[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...