Fix missing HSTS header for some URLs due to nginx "directive inheritance"[1]

F5/nginx has blogged about this[1] and it is also mentioned in nginx's documentation[2]: "There could be several add_header directives. These directives are inherited from the previous configuration level if and only if there are no add_header directives defined on the current level. "

The problem occurs when add_header is used in a child context like a server{} or location{} block. It is solved by moving the HSTS header into a snippet, which is now included before all add_header lines.

For now the HSTS header is the only global header, but in the future we may need to add more global headers, like the Alt-Svc header[3] for HTTP/3.

[1] https://www.f5.com/company/blog/nginx/avoiding-top-10-nginx-configuration-mistakes#directive-inheritance
[2] https://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
[3] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Alt-Svc

Fix #608 (closed)