feat(sandbox): use https as default protocol for sandboxing

The sandboxing protocol setting is used to determine where to redirect
users when sandboxing is enabled. Previously it defaulted to http or
https based on whether req.secure was true. In the default setup using
Envoy, that's never true because Envoy to service communication goes over
http. It could still be overriden using SANDBOX_PROTOCOL environment
variable, but most users haven't done that. This change switches the
default to https since most people deploy using https. Overrides for
http can still be accomplished using the environment variable.

Resolves #56

src/middleware/sandbox.ts

@@ -59,7 +59,7 @@ export function createSandboxMiddleware({
     if (reqSandbox !== idSandbox) {
       const queryString = url.parse(req.originalUrl).query ?? '';
       const path = req.path.replace(/\/\//, '/');
-      const protocol = sandboxProtocol ?? (req.secure ? 'https' : 'http');
+      const protocol = sandboxProtocol ?? 'https';
       return res.redirect(
         302,
         `${protocol}://${idSandbox}.${config.ARNS_ROOT_HOST}${path}?${queryString}`,