phabricator - enable HSTS with max-age 7 days

I4d207a4d makes phabricator HTTPS only. This patch
enables HTTP Strict Transport Security with a max-age
of 7 days, just like what we did on Bugzilla and on
Gerrit (I2b9e4536, I37924865). We will increase the
max-age to 1 year, one week after this patch is merged.

Bug: 38516
Change-Id: Ide46c1312a7bb9e9ebd2319da10185808bf41de0