StrictTransportSecurity for lists.wm.org

this is a bit different because lists.wm.org
uses lighttpd instead of Apache

Bug: 38516
Change-Id: I53f27e7d82b720b5557f42ceef7d7bb26c95590c
Merge "StrictTransportSecurity for lists.wm.org" into production