Why does my apache refuse the "Content-Security-Policy" headers?
If the value of the header contains spaces, you must surround it in double quotes. Your examples already do this, but your intended new headers do not.
For example, you tried:
Header always set Content-Security-Policy: frame-src 'self' *.google.de google.de *.google.com google.com;
It should be:
Header always set Content-Security-Policy: "frame-src 'self' *.google.de google.de *.google.com google.com;"