Implement HSTS preload

This allows browsers to query https directly instead of the initial http redirect

https://hstspreload.org/#opt-in says it should be explicitly opt in

src/apps.js

@@ -1765,7 +1765,7 @@ async function setReverseProxyConfig(app, reverseProxyConfig, auditSource) {
     assert.strictEqual(typeof reverseProxyConfig, 'object');
     assert.strictEqual(typeof auditSource, 'object');
 
-    reverseProxyConfig = _.extend({ robotsTxt: null, csp: null }, reverseProxyConfig);
+    reverseProxyConfig = _.extend({ robotsTxt: null, csp: null, hstsPreload: false }, reverseProxyConfig);
 
     const appId = app.id;
     let error = validateCsp(reverseProxyConfig.csp);