Remove deprecated/obsolete CSP directive

[guardrex]

Fixes #26483

Thanks @yugabe! 🚀

block-all-mixed-content is deprecated and obsolete.

Deprecated: This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.

Warning: This directive is marked as obsolete in the specification: all mixed content is now blocked if it can't be autoupgraded.

Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/block-all-mixed-content