fix: disable CSP upgrade-insecure-requests when HSTS is disabled

The upgrade-insecure-requests CSP directive was forcing browsers to
upgrade HTTP to HTTPS even when HSTS was disabled. Now both HSTS
and upgrade-insecure-requests are controlled by DISABLE_HSTS env var.

backend/app.js

@@ -42,6 +42,8 @@ app.use(
                 objectSrc: ["'none'"],
                 mediaSrc: ["'self'"],
                 frameSrc: ["'none'"],
+                upgradeInsecureRequests:
+                    process.env.DISABLE_HSTS === 'true' ? null : [],
             },
         },
         hsts: