Strict-Transport-Security: use preload and increase max-age

[php-coder]

After some time we should revisit our changes from #225 and add preload directive as well as increasing max-age to 3 months.

[php-coder]

https://observatory.mozilla.org/ complains that HTTP Strict Transport Security (HSTS) header set to less than six months (15768000)

[php-coder]

add preload directive as well as increasing max-age to 3 months

1. preload directive also requires includeSubDomains directive and max-age must be at least 31536000 seconds (≈ 1 year).

2. let's increase max-age to 6 months at least, to fix warnings from https://observatory.mozilla.org/

[php-coder]

After adding preload we should add our site to https://hstspreload.org/

[php-coder]

BTW this parameter is supported by Spring Security since 5.2.0.M2 (see https://spring.io/blog/2019/04/16/spring-security-5-2-0-m2-released)