First move your site to https because as of July 2018 Google chrome has started marking HTTP sites as not secure and I think other browsers will follow the suit. Link to official news
As for the CSP, I would recommend going with
Content-Security-Policy: upgrade-insecure-requests. This requests a https resource and if not available the request fails and the resource is not loaded.
Why not to go with
Content-Security-Policy: block-all-mixed-content - we will make mistakes once in a while till everyone is all caught up with HTTPS and no one uses HTTP anymore. Your favicon, logo or other resource might call HTTP request once in a while and that might block your main content.
upgrade-insecure-requests gives us an alternative to blocking it straight away than requesting a secure resource.
Assumption : Your site is not requesting too many 3rd party plugins or scripts or is an engine that calls 3rd party scripts to render content on your website. If yes, then by all means take precaution and use