Use Strict-Transport-Security includeSubDomains; preload (#9050)

Author: sigurdm

app/lib/shared/handler_helpers.dart

@@ -274,7 +274,7 @@ shelf.Handler _httpsWrapper(shelf.Handler handler) {
       rs = rs.change(
         headers: {
           'strict-transport-security':
-              'max-age=${_hstsDuration.inSeconds}; preload',
+              'max-age=${_hstsDuration.inSeconds}; includeSubDomains; preload',
         },
       );
     }

pkg/image_proxy/lib/image_proxy_service.dart

@@ -30,7 +30,7 @@ Map<String, String> securityHeaders = {
   'X-Content-Type-Options': 'nosniff',
   'Content-Security-Policy':
       "default-src 'none'; img-src data:; style-src 'unsafe-inline'",
-  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
+  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',
 };
 
 /// Ensure that [allowedKeys] contains keys for today and the two surrounding