fix nginx logic

[bengerman13]

Changes Proposed

• nginx config does not run top-to-bottom, so stop reusing variable names
• fix header reference name - we need upstreamhttp... since we want the response header
• use header reference name everywhere so we correctly control report-only and enforced headers
• add missing colon on more_set_headers directive
• add csp logic into http endpoint

Security Considerations

iterate on better security, but no direct impacts in this PR