all of these headers have their pros. Some of them have their cons as well. TL;DR: Use HSTS and X-Content-Type-Options.
Long version: Normally, especially the two standards in your list are important. Those are "HSTS" as well as "CSP". Everything that starts with an X is not really a standard. It is useful though. To check weather you can use it in a specific anvironment or not you could try for the website Can I use.
Anyhow. The HSTS header enforces the use of HTTPS as a "Trust on first use"-Principle. So after an initial visit on your site some information is saved by the browser. After hat the client (browser) will enforce HTTPS even if the user types "http". Man in the middle attacks will be a lot harder then.
The "Content Security-Policy" (when used correctly) will enforce that scripts are only executed from *.js-files. Even further you can (and should) tell the browser to only load from your page. This really does not help you from my pov because you dont serve HTML.
Same story for X-XSS-Protection.
These won't harm but won't really help as well.
So as for X-Content-Type-Options the MDN says:
The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should not be changed and be followed. This allows to opt-out of MIME type sniffing, or, in other words, it is a way to say that the webmasters knew what they were doing.
This may not be required for you and I do not really see the use-case but since your Content Type is always some SOAPy stuff you don't really suffer fom using it.
From my experience HSTS is a standard that everyone should use. HTTP without TLS is really kind of outdated and HTTPS without HSTS is a lot less secure then it could be. So for all of my projects I think of HSTS as mandatory. Just a final warning: Be careful when thinking about preloading. That my really limit your options to change something afterwards.