Conflicts: - `config/initializers/content_security_policy.rb`: Upstream added some code to add the Identity Provider's sign-in endpoint to the `form-action` Content Security Policy directive but our version of the file is pretty different. Ported the change.