Add path based exclusions to HSTS and Rewriter middleware

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

Due to a long and woeful story I ended up having to recreate one of my websites in a new azure subscription.

As you may know Azure offers managed service certificates for free, much like Let's Encrypt, but from another provider.

The issuance checks failed due to HSTS - the agent the provider uses obeyed the HSTS directive, along with following the HTTPS redirect, which lead it to an invalid SSL certificate because it's the default one issued for the azurewebsites domain.

This puts you in an awkward position, you can't get a correct certificate, because the current one is invalid and you're stuck in a circle until you turn HSTS off.

### Describe the solution you'd like

Add the ability to exclude certain file paths from having the HSTS header added by app.UseHsts() and from the HTTP to HTTPS redirection middleware in app.UseRewriter(). Rewriter already has domain inclusion, so it'd be an expansion of that.

By default you could consider having the following two paths in the exclusion list to allow for cert requests to proceed if the existing HTTPS certificate is invalid.

`/.well-known/pki-validation/` for azure's managed certificates
`/.well-known/acme-challenge/` for let's encrypt

### Additional context

_No response_