Backend CSP: revert change to form-action

[matthew-white]

• This is a follow-up issue to There is no error message informing user about entering wrong password when downloading submissions from encrypted project #2080
• This issue is to revert the following change to the CSP: Adjust form-action of Backend CSP #2197
• This issue is blocked by the following: Always submit HTML form for submission decryption from /blank.html #2206