Set an HSTS header to require SSL for 1 month

Currently we're not setting HSTS anywhere on our domains.

I'm hoping that this will avoid the annoying situation where by:

    $ curl -v http://assets.performance.service.gov.uk/spotlight/stylesheets/spotlight.css

does not receive a response. Ideally we'll be able to increase this once we verify that it's working as expected. GOV.UK currently sets this to be 1 year.