Rewrite HSTS

This rewrites HSTS to have the following API:

```javascript
app.use(helmet.hsts({
  maxAge: 12340000, // required parameter, now in milliseconds
  includeSubdomains: true
})
```

If it's Express, it'll set the header if `req.secure` is truthy. Otherwise, there are two ways to set the header:

```javascript
app.use(helmet.hsts({ maxAge: 1000, force: true }))
app.use(helmet.hsts({
  maxAge: 2000,
  setIf: function (req, res) {
    // Will set the header if this function returns a truthy value.
    return req.url == '/please_set_header';
  }
})
```

Thoughts?