SEC-3038: Warn of default HSTS header impact in migration docs

Thomas Timbul (Migrated from SEC-3038) said:

The enabling of HSTS by default can have a huge impact on sites that have never used HSTS before and may be unaware that this can (and likely will) break a site with mixed content.

Although the documentation mentions that HSTS is now enabled by default, there should be a large and explicit warning that it should either be disabled explicitly (though perhaps not recommended), or ALL content must be switched to using https.
It should be clearly highlighted that in simple terms the effect of HSTS is for the browser to permanently (for a year) remember your site as using https only, so that having both http content and HSTS will cause infinite redirects in browsers that support HSTS (i.e. all modern ones).

The steps to remedy should then be explained in case this issue had been encountered (for example configure HSTS with max-age=0).

Locate the migration documentation that states HSTS is enabled by default and review how the current behavior is explained. Add an explicit warning about mixed HTTP/HTTPS content and describe the documented remediation, including disabling HSTS or configuring max-age=0; done when the warning and recovery steps are clear in the migration docs.