feat: Bulk fixes (#1195)

remove ckeditor - not in use
add more strict default password validators
set Django admin as configurable URL
add nginx HSTS and CSP headers
enable moving from private to unlisted in the PORTAL_WORKFLOW private
on default comments listing, show only comments for public media
in case of a private media, dont expose any unneeded metadata

cms/dev_settings.py

@@ -26,7 +26,6 @@ INSTALLED_APPS = [
     "crispy_bootstrap5",
     'uploader.apps.UploaderConfig',
     'djcelery_email',
-    'ckeditor',
     'drf_yasg',
     'corsheaders',
 ]