cmd/godoc,cmd/tip: enable HSTS preload

Add the includeSubDomains directive to meet the requirements
for being added to the preload list described at https://hstspreload.org/.

Updates golang/go#26162

Change-Id: I415775aa523bcef3a52f1853de033f343b914e83
Reviewed-on: https://go-review.googlesource.com/122175
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

cmd/godoc/handlers.go

@@ -55,7 +55,7 @@ func (h hostEnforcerHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, r.URL.String(), http.StatusFound)
 		return
 	}
-	w.Header().Set("Strict-Transport-Security", "max-age=31536000; preload")
+	w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
 	h.h.ServeHTTP(w, r)
 }
 

cmd/tip/tip.go

@@ -408,7 +408,7 @@ func (h httpsOnlyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if r.Header.Get("X-Appengine-Https") == "on" || r.Header.Get("X-Forwarded-Proto") == "https" ||
 		(!isProxiedReq(r) && r.TLS != nil) {
 		// Only set this header when we're actually in production.
-		w.Header().Set("Strict-Transport-Security", "max-age=31536000; preload")
+		w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
 	}
 	h.h.ServeHTTP(w, r)
 }