Set an HSTS header to require SSL for 1 month

Currently we're not setting HSTS anywhere on our domains.

I'm hoping that this will avoid the annoying situation where by:

$ curl -v http://assets.performance.service.gov.uk/spotlight/stylesheets/spotlight.css

does not receive a response. Ideally we'll be able to increase this
once we verify that it's working as expected. GOV.UK currently sets this
to be 1 year.
Merge pull request #456 from alphagov/set-hsts-header

Set an HSTS header to require SSL for 1 month