Where can Content-Security-Policy be configured?

For a customer I am implementing Facebook Pixel on their website, to allow them to collect marketing statistics. The Facebook Pixel is implemented with the following Javascript, in the <head> tag:

<script>
  !function(f,b,e,v,n,t,s)
    {if(f.fbq)return;n=f.fbq=function(){n.callMethod?
    n.callMethod.apply(n,arguments):n.queue.push(arguments)};
    if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
    n.queue=[];t=b.createElement(e);t.async=!0;
    t.src=v;s=b.getElementsByTagName(e)[0];
    s.parentNode.insertBefore(t,s)}(window,
    document,'script',
    'https://connect.facebook.net/en_US/fbevents.js');
    fbq('init', '*****************');
    fbq('track', 'PageView');
</script>
<noscript>
  <img height="1" width="1" src="https://www.facebook.com/tr?id=***************&ev=PageView&noscript=1" />
</noscript>

As you see, the script is calling a Javascript file on the connect.facebook.net domain. When the code is uploaded to the Production server, I get the following error in Chrome console, due to violation of the Content-Security-Policy directive:

Refused to load the script 'https://connect.facebook.net/en_US/fbevents.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' platform.twitter.com s3.amazonaws.com cdn.ckeditor.com cdn.syndication.twimg.com www.google-analytics.com ajax.googleapis.com player.vimeo.com".

I have gone through the source code for the website (which is built in PHP), and the Content-Security-Policy directive isn't configured anywhere there. Nor is it in the .htaccess file. Although I am not quite sure, if this can be done in the .htaccess file.

Edit: (added image of response headers)

As seen in the error message as well as in the screenshot above, there is a Content-Security-Policy directive defined somewhere and I need to find it, so I can whitelist the Facebook domain there. I am thinking, this might have been done on server level in the httpd.conf, file which I have no access to, since the website is hosted by an external hosting provider.

So my question is: Where can the Content-Security-Policy directive be configured if not in PHP code, a html <meta http-equiv> attribute or in the httpd.conf file? Can this be done else where?