🐛 fix csp for local env not recognizing localhost a valid

[michenly]

WHY are these changes introduced?

The CSP bug was found when using ngrok as public domain for local development (needed for customer account API development)

Steps to re-produce:

1. Follow public domain using ngrok with this guide
2. In a seperate terminal, start hydrogen with npm run dev:app
3. Goto above domain to see the errors in browser

WHAT is this pull request doing?

With a public domain, localhost:* SHOULD have been applied to enable the use of localhost:3100 for assets build. This rule was never hit while using localhost:3000 as domain since self rule has precedent.

This PR fix the rule by adding http protocol to the policy.

HOW to test your changes?

Follow the above steps to reproduce and see the errors for all asset related CSP errors goes away in browser.

Post-merge steps

Checklist

• I've read the Contributing Guidelines
• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've added a changeset if this PR contains user-facing or noteworthy changes
• I've added tests to cover my changes
• I've added or updated the documentation