Enable HSTS policy on taproot.watch

[hsjoberg]

We will never serve content on HTTP, so to improve security it makes sense to enable HSTS.

Serving via HTTPS is currently out of scope of fork-explorer, so this has to be done on a reverse proxy (Nginx, Apache, Caddy, etc). taproot.watch uses Caddy, so I'll take a look there.

[stp-ip]

This added to the site block for Caddy should do:

header {
	 Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
}

This sets the HSTS policy and also enables the site to be preloaded within browsers.
Preloading form, after the header is set: https://hstspreload.org/

[hsjoberg]

@stp-ip Thank you! This has now been enabled on taproot.watch and txt.taproot.watch. 💯