fix(docker): Disable CSP upgrade insecure requests setting

When running with the Node environment set to production, the server enables Helmet, which adds several headers that are important for web app security.

With the expectation that the app currently doesn't support HTTPS, this PR intentionally disables the Content Security Policy upgrade-insecure-requests header such that the app can be loaded over HTTP even off localhost.

This change doesn't preclude running the app with HTTPS

It's worth noting that the app already has no access control and thus should only be hosted either locally or on private/trusted local networks anyways. The server does not expose plaintext secrets, but the client does send secret values in plaintext to the server to save them.

Other minor fixes in this PR:

Add the server env files directory as a volume in docker-compose.yml

gafirst / match-uploader

fix(docker): Disable CSP upgrade insecure requests setting #58