feat: add HSTS header to responses

I'll bump the max time and get it preloading when I summon the courage.

server/Cargo.toml

···
 	"compression-full",
 	"fs",
 	"trace",
+	"set-header"
 ] }
 tracing = "0.1.34"
 tracing-subscriber = "0.3.11"

server/src/main.rs

···
 use crate::scrobble_monitor::ScrobbleMonitor;
 
 use axum::{
-    http::StatusCode,
+    http::{HeaderName, HeaderValue, StatusCode},
     response::IntoResponse,
     routing::{get, get_service},
     Extension, Router,
 };
 use tower::ServiceBuilder;
-use tower_http::{compression::CompressionLayer, services::ServeDir, trace::TraceLayer};
+use tower_http::{
+    compression::CompressionLayer, services::ServeDir, set_header::SetResponseHeaderLayer,
+    trace::TraceLayer,
+};
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
···
             ServiceBuilder::new()
                 .layer(TraceLayer::new_for_http())
                 .layer(CompressionLayer::new())
-                .layer(Extension(monitor)),
+                .layer(Extension(monitor))
+                .layer(SetResponseHeaderLayer::overriding(
+                    HeaderName::from_static("strict-transport-security"),
+                    HeaderValue::from_static("max-age=300; includeSubDomains"),
+                )),
         );
 
     let addr = SocketAddr::from(([0, 0, 0, 0], 8080));