Allow `force_https` to be shadowed by a global setting.

config/site_settings.yml

@@ -765,7 +765,9 @@ trust:
     client: true
 
 security:
-  force_https: false
+  force_https:
+    default: false
+    shadowed_by_global: true
   enable_escaped_fragments: true
   allow_index_in_robots_txt: true
   enable_noscript_support: true