Correct syntax for Strict-Transport-Security header with subdomains

Ad least on Debian, the original line does not pass apache2ctl configtest.