The Referrer-Policy header controls how much referrer information the browser exposes to a site when navigating to it. I understand the purpose of this header when set on HTML files; does it make sense to set this header on non-HTML resources like images, scripts, etc.? Does any browser pay attention to the header’s value in this situation?
Source: MDN Referrer Policy
So, if you need the security from setting that header, you should probably look for other methods as well.
Yes, it does makes sense because Non HTML files can contain sensitive data. If a browser does not check the referrer policy of a http request then anyone can access any files.
An example of this is http cookies; An unchecked malicious script could easily access sensitive information stored in cookies if the referrer-policy was not checked.
Using the data in the referrer-policy means you can apply security concepts such as same-origin policy.
To quote Wikipedia:
This policy prevents malicious scripts on one page from obtaining access to sensitive data on another webpage through that pages document object model.
does it make sense to set this header on non-HTML resources like images, scripts, etc.?
No, it's irrelevant because the referrer-policy header is not sent for those page assets.
Test for yourself, substituting example.com for another domain. Alternatively, you can use the web developer tools of your browser (if it supports this) to examine headers with a GUI.
curl --head https://www.example.com/index.html | grep referrer-policy
curl --head https://www.example.com/favicon.ico | grep referrer-policy
curl --head https://www.example.com/image.jpeg | grep referrer-policy
Only the index.html resource is sent with that header value.