default to "includeSubdomains" for HSTS

This makes the default assumption that for domains and subdomains we control, their higher-level subdomains can also be guaranteed to use HTTPS. When not the case, a weaker line can be swapped in, also commented-out in the rules file.

I have updated the server that responds to https://18f.us to *not* use `includeSubdomains`, so that we can continue to use 18f.us subdomains without HTTPS during initial development. Eventually, when we automate our certificate deployment and rotation policies further, we may be able to undo this without causing undue heartache.

cc @noahkunin @seanherron @jgrevich