updated heroku plans and review app csp directives

[danielfmiranda]

Closes #1745

Updates app.json to use heroku's "mini" plan for review apps.

Also updates review app's default CSP directives to include URLs required for FundraiseUp to work.

For CSP reference, see: https://fundraiseup.com/support/content-security-policy/