Only use strict transport security for the discourse domain

This is a minor fix to have Discourse's SSL configuration to only enforce HSTS for the domain running Discourse.

The header currently bundles `includeSubDomains`, which incorrectly enforces HSTS for any subdomain of the one used by Discourse. If your domain was `meta.discourse.org`, this would include `beta.meta.discourse.org`.

As this luckily does not affect all subdomains of the root domain, this should be considered low priority, as there is likely few users using subdomains of their discourse domain.