Play Framework

fix(security): load the Google CSE search box over HTTPS

The docviewer pages and the Japanese welcome template embedded the Google
Custom Search box with a plain-HTTP script tag:

  <script src="http://www.google.com/coop/cse/brand?...">

Google 301s that to https://www.gstatic.com/prose/brandjs.js, but the redirect
is no protection: the first request still leaves the browser over HTTP, so a
network attacker answers it themselves rather than letting the redirect happen,
and their JavaScript runs in the page's origin (js/functionality-from-untrusted-
source). Reachable by anyone running `play run` and opening /@docs on an
untrusted network.

Verified the endpoint is live and that HTTPS serves the identical payload -
both schemes return 200 with the same 13880 bytes - so this is a scheme change
only, not a removal. The form action moved to HTTPS in the same pass.

No Tailwind regeneration needed: no class names changed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>