Their app developers unless it is set globally and in that case their network engineering team.

Which resources would have the header and which wouldn’t?

If the app developers send the header on any video flagged as adult then just specific videos. If they created a unique URL that all adult content would reside under then it could potentially be the network engineers. It really depends on how much work they put into it so that more people could view the content assuming user agents become legislated to check for the header.