How to enable HSTS (HTTP Strict Transport Security) in Red Hat OpenStack Platform

Issue

• Currently it is possible to enable SSL/TLS everywhere in your Overcloud via utilising the novajoin or tripleo-ipa methods.
• By default if SSL is enabled in Horizon, the X-Forwarded-For header is set, but not the Strict-Transport-Security header which HSTS provides.
• HSTS, (which operates at the browser level), is important to protect from downgrade attacks, man-in-the-middle attacks, and session hijacking. It does so by preventing the page from being loaded without HTTPS.