Add upgrade-insecure-requests directive to Content Security Policy

[robhudson]

This issue proposes adding the upgrade-insecure-requests directive to our Content Security Policy (CSP). The upgrade-insecure-requests directive automatically upgrades HTTP requests to HTTPS, helping enforce secure communication for all resources while ensuring compatibility with legacy HTTP links.