remove block-all-mixed-content from helmet-csp default directives

block-all-mixed-content has been deprecated as detailed here https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/block-all-mixed-content and is basically build into the Content-Security-Policy

while its not doing anything as chrome is ignoring the directive it just bothers me slightly that its there