Set HSTS headers to enforce use of HTTPS

Content & configuration

Swagger/OpenAPI definition:
Running Swagger UI from the official docker image using the following environment variables to define my runtime config:
BASE_URL
CONFIG_URL
OAUTH_USE_PKCE

Is your feature request related to a problem?

Pen testing and security vulnerability scanning tools frequently report on the lack of HSTS from our API since docs are hosted under the same domain.

Describe the solution you'd like

I'd like HSTS to either be enabled by default in the swagger UI docker image or alternately to be able to turn it on using an environment variable or property in the config.json.

Describe alternatives you've considered

Creating my own docker image that uses a custom nginx.conf, which is not ideal since I prefer to remain on the most recent official docker images.

Additional context

This is somewhat related to a similar request here: https://github.com/swagger-api/swagger-ui/issues/8379

Start with the official Swagger UI Docker image and its nginx.conf, then trace how BASE_URL, CONFIG_URL, and OAUTH_USE_PKCE are supplied. Compare adding HSTS by default with exposing an environment variable or config.json property, and verify that the running image emits the expected HSTS header without requiring a custom image.