Add preload support to Strict-Transport-Security

1. Preload support in Servlet Security(XML & Java)
2. Preload support in Reactive Security
3. Test for preload support in Servlet Security
4. Test for preload support in Reactive Security

Fixes: gh-6312

docs/manual/src/docs/asciidoc/_includes/reactive/headers.adoc

@@ -174,11 +174,14 @@ For example the following would instruct the browser to treat the domain as an H
 
 [source]
 ----
-Strict-Transport-Security: max-age=31536000 ; includeSubDomains
+Strict-Transport-Security: max-age=31536000 ; includeSubDomains ; preload
 ----
 
 The optional includeSubDomains directive instructs Spring Security that subdomains (i.e. secure.mybank.example.com) should also be treated as an HSTS domain.
 
+The optional preload directive instructs Spring Security that domain should be preloaded in browser as HSTS domain. For more details on HSTS preload please see
+https://hstspreload.org.
+
 As with the other headers, Spring Security adds HSTS by default.
 You can customize HSTS headers with Java Configuration:
 
@@ -191,6 +194,7 @@ SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
 		.headers()
 			.hsts()
 				.includeSubdomains(true)
+				.preload(true)
 				.maxAge(Duration.ofDays(365));
 	return http.build();
 }

docs/manual/src/docs/asciidoc/_includes/servlet/appendix/namespace.adoc

@@ -336,6 +336,10 @@ Default one year.
 The RequestMatcher instance to be used to determine if the header should be set.
 Default is if HttpServletRequest.isSecure() is true.
 
+[[nsa-hsts-preload]]
+* **preload**
+Specifies if preload should be included.
+Default false.
 
 [[nsa-hsts-parents]]
 ===== Parent Elements of <hsts>

docs/manual/src/docs/asciidoc/_includes/servlet/web/headers.adoc

@@ -295,11 +295,14 @@ For example the following would instruct the browser to treat the domain as an H
 
 [source]
 ----
-Strict-Transport-Security: max-age=31536000 ; includeSubDomains
+Strict-Transport-Security: max-age=31536000 ; includeSubDomains ; preload
 ----
 
 The optional includeSubDomains directive instructs Spring Security that subdomains (i.e. secure.mybank.example.com) should also be treated as an HSTS domain.
 
+The optional preload directive instructs Spring Security that domain should be preloaded in browser as HSTS domain. For more details on HSTS preload please see
+https://hstspreload.org.
+
 As with the other headers, Spring Security adds HSTS by default.
 You can customize HSTS headers with the <<nsa-hsts,<hsts>>> element as shown below:
 
@@ -311,7 +314,7 @@ You can customize HSTS headers with the <<nsa-hsts,<hsts>>> element as shown bel
 	<headers>
 		<hsts
 			include-subdomains="true"
-			max-age-seconds="31536000" />
+			max-age-seconds="31536000" preload="true" />
 	</headers>
 </http>
 ----
@@ -331,6 +334,7 @@ protected void configure(HttpSecurity http) throws Exception {
 	.headers()
 		.httpStrictTransportSecurity()
 			.includeSubdomains(true)
+			.preload(true)
 			.maxAgeSeconds(31536000);
 }
 }