fix(security): update HSTS to 31536000

[chenba]

Update HSTS to the value asked on the Security Checklist.

For consistency, I'm updating all the HSTS max-age values in the monorepo.

Part of #1128

@mozilla/fxa-devs r>

[lmorchard]

LGTM - though I wonder why it was at 180 days instead of a year?

I'm fuzzy on understanding HSTS. I think this means, when set to one year, that we cannot disable HSTS for one year. (i.e. we can't go back to serving things as non-SSL http://) But that seems okay because we will never want to disable HSTS - does that seem correct?

[chenba]

We can force it to expire by setting 0. But like you said, I don't see why we'd want to do that.

[shane-tomlinson]

I'm not sure why we weren't at 1 year, and it seems like we should add subscriptions.firefox.com to the HSTS preload list. We aren't sending the preload parameter in the header either, strange.

@jrgm - does anything need to be added to the nginx config to update hsts values?

[shane-tomlinson]

We aren't sending the preload parameter in the header either, strange.

accounts.firefox.com and its subdomains are pre-loaded, @jrgm and @fmarier did the grunt work long ago.

[shane-tomlinson]

Ref https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json?pathrev=290628#l818

[shane-tomlinson]

mozilla/fxa-content-server#208 on why we set to 180 days, I note that value was "tentative".