What is the most appropriate HTTP status code to return if a required header is missing?

400 Bad Request

It's a user error in the request. Unlike with a 403, the client should be allowed to repeat their request, but only after modification:

10.4.1 400 Bad Request The request could not be understood by the server due to malformed syntax. The client SHOULD NOT repeat the request without modifications.

Edit

As Mark Reed points out in the comments, a 403 says, "There is nothing wrong with what you sent me. You have proper authorization and the syntax was valid. I just don't want to do what you ask."

The part that you have in bold simply says, if the server so chooses, it can tell the client exactly why it doesn't want to fulfill the request.

json.dump throwing "TypeError: {...} is not JSON serializable" on seemingly valid object?

Are Users 'User'@'%' and 'User'@'localhost' not the same?

Accuracy of approximation to inclusion-exclusion formula in prime sieve

Why do we define the $\mathfrak{p}$-adic logarithm on a $\mathfrak{p}$-adic number field such that $\log(p) = 0$?

Proof that there is no Banach-Tarski paradox in $\Bbb R^2$ using finitely additive invariant set functions?

Example of contractible open manifold that is not $\mathbb{R}^n$ - varieties?

Isomorphic rings or not?

Can a probability density function take negative values?

Is every invertible matrix a change of basis matrix?

What's the component interval?

Every simple planar graph with $\delta\geq 3$ has an adjacent pair with $deg(u)+deg(v)\leq 13$