Repository: static-web-server/static-web-server (language: rust)

Issue:
Security headers not enabled by default when using config.toml
**Describe the bug**
When using a config file instead of CLI flags like this:

```
[general]
http2 = true
http2-tls-cert = "local.dev_cert.pem"
http2-tls-key= "local.dev_key.pem"
log-level = "trace"
```
Security headers don't get enabled:

```
2023-05-29T17:21:52.159831Z  INFO static_web_server::server: security headers: enabled=false
```

**Expected behavior**
Security headers should be enabled automatically when using http2 per the docs: https://static-web-server.net/features/security-headers/

**Environment and Specs**
 - static-web-server: 2.16.0 (built from commit 0f66443)
 - OS: Linux

**Additional context**
I'm suspecting some relation to #209. Something buried in the clap/structopt code is mishandling booleans I think, especially in `default_value_if` which has changed in clap v4 to take different type parameters: https://docs.rs/clap/4.3.0/clap/struct.Arg.html#method.default_value_if




Discussion / hints:
> I'm suspecting some relation to #209. Something buried in the clap/structopt code is mishandling booleans I think, especially in `default_value_if` which has changed in clap v4 to take different type parameters: https://docs.rs/clap/4.3.0/clap/struct.Arg.html#method.default_value_if

For now, the workaround for this should be just enabling the `security-headers` explicitly in the TOML file along with `http2`.

```toml
[general]
# ....

http2 = true
http2-tls-cert = "local.dev_cert.pem"
http2-tls-key= "local.dev_key.pem"
log-level = "trace"

# Opt-in security headers explicitly
security-headers = true
```

BTW I will update the docs to mention this until we find a solution.

Fix patch:
diff --git a/src/settings/mod.rs b/src/settings/mod.rs
index 746d9d7a..9edf3421 100644
--- a/src/settings/mod.rs
+++ b/src/settings/mod.rs
@@ -197,8 +197,13 @@ impl Settings {
                     if let Some(v) = general.https_redirect_from_hosts {
                         https_redirect_from_hosts = v
                     }
-                    if let Some(v) = general.security_headers {
-                        security_headers = v
+                    match general.security_headers {
+                        Some(v) => security_headers = v,
+                        _ => {
+                            if http2 {
+                                security_headers = true;
+                            }
+                        }
                     }
                     if let Some(ref v) = general.cors_allow_origins {
                         cors_allow_origins = v.to_owned()


Test patch: