Remove ControllerHelpers::SSL `force_ssl_redirect`

Turns out that Rails 4 introduced a `force_ssl_redirect` as well and
so that method got overriden from within spree core. The spree
implementation however expected the only param passed to be a string or
something that we could assign :host and on Rails ForceSSL a hash is
given instead so this statement would be true

    redirect_options.merge!(:host => host) if host

and users would get the error described in https://github.com/spree/spree/issues/3283

Here's the current Rails ForceSSL implementation https://github.com/rails/rails/blob/v4.0.0/actionpack/lib/action_controller/metal/force_ssl.rb#L66
and in 3.2.14 https://github.com/rails/rails/blob/v3.2.14/actionpack/lib/action_controller/metal/force_ssl.rb

Removing the `force_ssl_redirect` from spree core seems to fix the issue
as that method was just a copy of the old implementation of Rails
`force_ssl` which is already called from spree SSL module

Remove spec setting application.config.force_ssl true

It doesn't represent a valid use case. By the time that code is run
the application is already initialized so that really doesn't make any
difference. We would have to add `force_ssl` inside the
ProductsController class to make the spec pass, only that it breaks
other specs so I believe we'd rather remove it

In Rails 4 SSL application wide is taken care of a middleware called
ActionDispatch::SSL which is included on the app load. Looks like
`force_ssl` is only used on the Controller level
Fix redirect loop with redirect_https_to_http

force_non_ssl_redirect was testing if the actions was included in
ssl_{required,allowed}_actions, but didn't consider the case that it was
empty (which should mean all actions). This caused an infinite redirect
loop on admin and checkout pages with the option enabled.

This fixes the issue and simplifies the code by combining the lists of
allowed and required ssl actions. Also added some specs.

Fixes #3813