roles/nginx: Make sure to set HSTS headers on WordPress static files

I realized the other day that due to complex logic in the location
blocks, various WordPress static files like images and stylesheets
didn't get the HTTP Strict Transport Security header set. We need
to include it on each level where we are setting headers, because
nginx overwrites headers if you set them again in a child block.

roles/nginx/templates/wordpress.j2

@@ -4,10 +4,24 @@
     # also serves static files from the disk instead of passing to interpreter.
     location / {
         try_files $uri $uri/ /index.php?$args;
+
+        {% if enable_hsts == True %}
+        # Enable this if you want HSTS (recommended, but be careful)
+        # Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
+        # See: https://hstspreload.appspot.com/
+        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
+        {% endif %}
     }
 
     location ~* \.(?:ico|css|js|gif|jpe?g|png|svg)$ {
         add_header Cache-Control "max-age=604800";
+
+        {% if enable_hsts == True %}
+        # Enable this if you want HSTS (recommended, but be careful)
+        # Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
+        # See: https://hstspreload.appspot.com/
+        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
+        {% endif %}
     }   
 
     # Add trailing slash to */wp-admin requests.