Add HSTS response header

[jonnalley]

Goals

• Address ACF Tech "low" finding in all environments
• Infra config would all be captured in IaC

Tasks

• Assemble necessary TF module/resource for an AppGW Rewrite rule for a Strict-Transport-Security response header being set with no conditions.
• Plan and Apply in all environments
• Test out interactions in the app, including uploading files?

Additional Context

• In the SDLC app gateway currently, this is enabled in addition to the CORS rules that Reed temporarily added as a troubleshooting tool. He reports his CORs rules are not needed though.
• The value tested thus far was max-age=300; includeSubDomains; preload. Some best practices for the max-age value (X) seem to be 1-2 years. One year is 31536000 and 2 is 63072000
• If trouble arises, maybe try a much lower max-age (like 300) or taking out the preload as a troubleshooting step.

Resources