URL params should be scrubbed for HTML injection when redirecting HTTP -> HTTPS

When "Force Secure URLs" is enabled, CiviCRM redirects HTTP requests to HTTPS. If the request had URL params with injected HTML, the same injected HTML appears in the "Location:" header of the redirect response.

I don't believe there is a real vulnerability here, but some PCI compliance scanners will flag this and fail the scan. I've successfully disputed with our scan vendor, but we should also consider scrubbing injected HTML from redirect responses.