Wrong Content-Security-Policy header for serve-web

Does this issue occur when all extensions are disabled?: Yes

- VS Code Version: 1.136.0
- OS Version: Ubuntu

> [!NOTE]
> This is an error config related to the serve-web feature

**Problem Description**:
The serve-web feature (denote as code-server below) sets Content-Security-Policy to `http://`. For example, if the hostname is `example.com`, then the Content-Security-Policy response header contains `http://example.com`. This usually OK, however, when the browser-side actual scheme is HTTPS (e.g. connect over a reverse proxy), the Content-Security-Policy blocks any resource to load

Steps to Reproduce:

1. `code serve-web`
2. Connect over https reverse proxy
3. Got blank page with lots of CSP violations