Match the HSTS settings on `accounts.firefox.com`

We need the `includeSubdomains` option because we've requested that
to be preloaded in browsers. In addition, the HSTS headers on
`api.accounts.firefox.com` should match the ones on the parent
domain.

This is a followup to #747.