Drupal preprocess html to force all assets to https with hsts contrib module enabled

your_theme_name.theme

<?php

function your_theme_name_preprocess_html(&$variables) {
  // You can remove this if and leave only it's content if you don't need it 
  // or the contrib module hsts is not enabled on your Drupal.
  if (\Drupal::moduleHandler()->moduleExists('hsts')) {
    $content_security_policy = [
      '#tag' => 'meta',
      '#attributes' => [
        'http-equiv' => 'Content-Security-Policy',
        'content' => 'upgrade-insecure-requests',
      ],
    ];
    $variables['page']['#attached']['html_head'][] = [$content_security_policy, 'Content-Security-Policy'];
  }
}