fix(middleware): default HSTS header in production

[bpamiri]

Summary

• SecurityHeaders middleware now auto-defaults Strict-Transport-Security: max-age=31536000; includeSubDomains when environment is production and no explicit HSTS value is provided
• Adds environment parameter to init() with fallback to application.$wheels.environment so existing users get HSTS protection without config changes
• Fully backward compatible: non-production environments and empty environment continue to omit HSTS unless explicitly set

Test plan

• Verify HSTS auto-defaults when environment="production" and no explicit value
• Verify HSTS is NOT set for development, testing, or empty environment
• Verify explicit HSTS values override the auto-default in production
• Verify backward compatibility: no HSTS when no environment param passed
• All 2672 tests pass locally (Lucee 7 + SQLite), 0 failures

🤖 Generated with Claude Code