This reverts commit 8a11e382.

The namespace `metabase.server.middleware.security` controls our content
security policy header. In dev we allow connections to 8080 for webpack
assets. Not dev we deny these.

`clj -M:run` is dev since it is running the project from source, not a
jar. This `mb.run.mode` was removed when we were fighting require issues
for `metabase.query-processor-test.test-mlv2`. That's solved so we can
restore the dev property to `:run`.