How to force Safari to warn before leaving a page when a form is filled in but not submitted

Strictly speaking, no. For simple HTML forms using Common Gateway Interface (CGI), the web page you see is the output of a process which uses the form data as an input. Put another way, the server needs the form data to generate the page. There a lot of ways to get around that using back-end databases, cookies, javascript, etc. But generally speaking: no-form, no-result.

You mentioned clicking in the URL bar and pressing return, but if the form uses the GET method (form data in the URL itself), then clicking in the URL bar and pressing return does effectively resend it. However, if the form uses the POST method (form data sent in the HTTP request body), then clicking the URL bar and pressing will not send the form data and so the page will not be regenerated.

Note that if you tell Safari to reload a form-result page, it will usually ask you to confirm that you really want to do that, then resend the form data. The reason it asks is that there may well be some side-effect of the form (like charging your credit card) which you might not want to repeat. That's poor CGI design, but it happens.

So, as noted in the update, Safari does actually warn you -- once.

If you decide to proceed anyway, then for the remainder of that browser session, you need to remember that you're talking to a potentially compromised server, because you will see no evidence of that except by examining the certificate (by clicking on the https/padlock icon).

However, exiting Safari and restarting it restores the warning. A visit to the compromised site in the new instance of the browser once again presents the warning.