Update HSTS header (#8824)

Author: zhhyu

src/NuGetGallery/Web.config

@@ -382,7 +382,7 @@
         <add name="X-Frame-Options" value="deny"/>
         <add name="X-XSS-Protection" value="1; mode=block"/>
         <add name="X-Content-Type-Options" value="nosniff"/>
-        <add name="Strict-Transport-Security" value="max-age=31536000"/>
+        <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains"/>
       </customHeaders>
     </httpProtocol>
     <handlers>