fix(csp): allow secure.helcim.app for HelcimPay.js

The HelcimPay modal loads from secure.helcim.app, but the CSP only
listed myposjs.helcim.com (script/connect) and secure.helcim.com
(frame, likely a stale typo). Add secure.helcim.app to script-src,
connect-src, and frame-src so the join flow's payment modal can load.

tests/server/middleware/security-headers.test.js

@@ -86,7 +86,7 @@ describe('security-headers middleware', () => {
       const csp = event._testSetHeaders['content-security-policy']
       expect(csp).toContain('myposjs.helcim.com')
       expect(csp).toContain('api.helcim.com')
-      expect(csp).toContain('secure.helcim.com')
+      expect(csp).toContain('secure.helcim.app')
     })
 
     it('includes Cloudinary sources in CSP', () => {