An attacker loads your site in an invisible <iframe> and tricks users into clicking its buttons. Which header prevents this?

This attack is called clickjacking. frame-ancestors controls who may embed your page in a frame. 'none' means nobody can. The older header that does the same is X-Frame-Options: DENY.

frame-src is the tempting wrong answer. It controls which frames your page may embed, not who can frame your page. Access-Control-Allow-Origin is a CORS header for reading responses, and Strict-Transport-Security forces HTTPS. Neither stops framing.