build: avoid https request locally

Author: ShroXd

modules/security-headers.ts

@@ -55,7 +55,7 @@ export default defineNuxtModule({
       `form-action 'self'`,
       `object-src 'none'`,
       `manifest-src 'self'`,
-      'upgrade-insecure-requests',
+      ...(!nuxt.options.dev ? ['upgrade-insecure-requests'] : []),
     ].join('; ')
 
     // CSP via <meta> tag — only present in HTML pages, not API responses.