how to set up X-Content-Type-Options header?

You could look at using a mapping template to override an API's request and response parameters and status codes.

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-override-request-response-parameters.html

The advantage to doing this header manipulation in the API Gateway is that by doing it there over the Lambda Function it keeps your lambda runtime quicker. Since Lambda is billed by runtime, this can also be more cost effective.