fix: keep includeSubdomains when STSPreload is enabled

[c879873067877881111]

When both STSIncludeSubdomains and STSPreload are set, the
Strict-Transport-Security header drops includeSubdomains and only sends:

max-age=315360000; preload

The preload branch in policy.go was overwriting stsSub instead of
appending to it:

if config.STSPreload {
    stsSub = "; preload"
}

Changed it to += so both directives are kept:

max-age=315360000; includeSubdomains; preload

Added a test for the both-enabled case.

Note: #52 also asks whether STSPreload should be enabled by default in
DefaultConfig(). I left that out here since it changes default behaviour —
happy to do a follow-up if you'd like.

Refs #52