Turn on HTTP Strict Transport Security `includeSubdomains` option

[strugee]

https://sandstorm.io currently serves a Strict-Transport-Security: max-age=31536000 header, which is phenomenal. It'd be even more phenomenal if it had the includeSubdomains option, and was in the preload list.