Add HSTS header in nginx

This is pretty opinionated but it's time to get rid of http :)