upgrade-insecure-requests Content-Security-Policy directive
The upgrade-insecure-requests directive is evaluated before block-all-mixed-content and if it is set, the latter is effectively a no-op because upgrade-insecure-requests should upgrade all requests to HTTPS.
Unfortunately, Chrome <= 68 doesn't implement upgrade-insecure-requests properly and if it requests an HTTPS resource redirecting to an HTTP resource, it won't force this new request to HTTPS, creating a mixed-content context.
