Can the Upgrade: header have spaces between the comma?

This is probably best answered by the RFC defining HTTP headers: RFC 2616.

In section 4.2, defining the general form of headers, is written:

Any LWS [linear white space] that occurs between field-content MAY be replaced with a single SP before interpreting the field value or forwarding the message downstream.

And the header format:

   message-header = field-name ":" [ field-value ]
   field-name     = token
   field-value    = *( field-content | LWS )
   field-content  = <the OCTETs making up the field-value
                    and consisting of either *TEXT or combinations
                    of token, separators, and quoted-string>

Note the section about field-content. The section describing the upgrade header in special, 14.42, does not mention any further restrictions. This is why my answer to your question is: Yes, space in between the values should be legal.

[EDIT]
Sorry about citing the wrong RFC, the correct one is RFC7231 - but my answer is still valid, see Appendix B. This section lists the changes from the obsolete RFC 2616, and a change of the header format is not listed.

The new definition, which is quite similiar, is found in RFC 7230, Secion 3.2:

 header-field   = field-name ":" OWS field-value OWS

 field-name     = token
 field-value    = *( field-content / obs-fold )
 field-content  = field-vchar [ 1*( SP / HTAB ) field-vchar ]
 field-vchar    = VCHAR / obs-text

 obs-fold       = CRLF 1*( SP / HTAB )
                ; obsolete line folding
                ; see Section 3.2.4