Add an HSTS off-switch to `SecurityHeaders` middleware

[bpamiri]

Problem

vendor/wheels/middleware/SecurityHeaders.cfc auto-enables HSTS in production when strictTransportSecurity is empty, but there is no documented way to disable it.

Apps deployed behind a TLS-terminating proxy that already sets HSTS get duplicate Strict-Transport-Security headers. Setting strictTransportSecurity="" keeps the auto-default; setting it to "max-age=0" tells browsers to clear HSTS memory, which is worse than doing nothing.

Current workaround

The upgrading guide (upgrading/upgrading-to-4-0.mdx §2.4) instructs readers to pass an explicit strictTransportSecurity value matching their proxy's, so duplicate headers carry the same content. Browsers tolerate duplicates with matching values, but this is a workaround — not an off-switch.

Proposed fix

Add an explicit boolean constructor arg (e.g., emitHsts=true) that gates HSTS emission entirely. When false, skip the header regardless of environment and strictTransportSecurity value.

Alternatively, treat a sentinel value (e.g., strictTransportSecurity="none") as "skip this header."

Discovered during Phase 2c final review of v4 guides rewrite (#2169).