Leave the scheme off this origin's script sources

Behind a proxy that terminates TLS without X-Forwarded-Proto, Rails sees
http while the page is https, and an http source on a non-default port
doesn't match. A source without a scheme takes the page's own.

test/controllers/cached_responses_test.rb

@@ -29,7 +29,7 @@ class CachedResponsesTest < ActionDispatch::IntegrationTest
   test "a reused page carries the same enforcing policy, with no nonce" do
     get room_messages_url(@room)
     first = response.headers["Content-Security-Policy"]
-    assert_match %r{script-src http://[^/ ]+/assets/ 'sha256-}, first
+    assert_match %r{script-src [^/ ]+/assets/ 'sha256-}, first
     assert_no_match "nonce-", first
 
     MessagesController.any_instance.expects(:find_paged_messages).never