Functions runtime returning Strict-Transport-Security twice

### Summary

When deploying the code defined in this repo [annikel/swa-e2e-node-test](https://github.com/annikel/swa-e2e-node-test) to an Azure Function App the header _Strict-Transport-Security_ is returned twice. Since the code only defines one header the second header must be added by the functions runtime and seems to not consider any headers being set within the code.

❗ The behavior differs between different function apps.

### Investigative information

**This issue can only been see for some apps.**
- Example Function experiencing the issue: 190bd095-635e-49a7-8f02-dfacb9b95b11
- Example Function App not experiencing the issue: header-test-nextjs-linuxapp-node16

_Can not find a difference in between these two app_

####Repro steps

Provide the steps required to reproduce the problem:

Example:

1. Deploy the code defined in this repo [annikel/swa-e2e-node-test](https://github.com/annikel/swa-e2e-node-test) to an Azure Function App
2. Hit the _api/GetMessage_ endpoint and view returned headers

#### Expected behavior

- After performing step 2 only one Strict-Transport-Security header should be returned

#### Actual behavior

- After performing step 2 **two** Strict-Transport-Security header are returned. One containing the value defined in the code and one additional with a different value

### Related information

- node|16
- linux

```csharp

const fs = require('fs');
const util = require('util');
const readFileAsync = util.promisify(fs.readFile);

module.exports = async function (context, req) {
context.log('JavaScript HTTP trigger function processed a request.');

let message;
try {
message = await readFileAsync('./GetMessage/content.txt');
} catch (err) {
context.log.error('ERROR', err);
// This rethrown exception will be handled by the Functions Runtime and will only fail the individual invocation
throw err;
}

context.res = {
// status: 200, /* Defaults to 200 */
body: message,
headers: {
"Strict-Transport-Security": "max-age=63072000; includeSubDomains; preload",
},
};
}
```

Start by deploying annikel/swa-e2e-node-test to the two named Azure Function Apps and request the api/GetMessage endpoint while inspecting all Strict-Transport-Security response headers. Compare the app configuration and runtime behavior for 190bd095-635e-49a7-8f02-dfacb9b95b11 and header-test-nextjs-linuxapp-node16; done means identifying why only some apps add a second header and documenting or verifying a single returned header.

Written by the indexing model from the issue text.