Enforce Strict-Transport-Security for serverless offering

[legrego]

The HTTP Strict-Transport-Security response header (often abbreviated as HSTS) informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS.

Our serverless offering will always be served over HTTPS, and so we should configure this response header accordingly. That said, we want to make sure that this is NOT set by default for local development, as we don't want to require all devs to configure TLS.

We already expose this as a configuration option for on-prem installs, so it'll "just" be a matter of updating the configured value when running within a serverless context:

kibana/packages/core/http/core-http-server-internal/src/security_response_headers_config.ts

Lines 12 to 15 in 6ad108d

	strictTransportSecurity: schema.oneOf([schema.string(), schema.literal(null)], {
	// See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
	defaultValue: null,
	}),

Recommended value Strict-Transport-Security: max-age=31536000; includeSubDomains.

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[legrego]

Closing in favor of #150884