Comply with HSTS RFC

From the [RFC documentation](https://tools.ietf.org/html/rfc6797#section-7.2)
it seems like we "SHOULD" make the http->https redirect permanent (301)
instead of a temporary redirect (302), and that we "MUST NOT" include an
STS header in our redirect response over HTTP which is insecure.

jupyterhub/templates/proxy/autohttps/_configmap-dynamic.yaml

@@ -22,6 +22,7 @@ http:
     # A middleware to redirect to https
     redirect:
       redirectScheme:
+        permanent: true
         scheme: https
     # A middleware to add a X-Scheme (X-Forwarded-Proto) header that
     # JupyterHub's Tornado web-server needs if expecting to serve https
@@ -69,7 +70,6 @@ http:
       entrypoints:
         - "http"
       middlewares:
-        - "hsts"
         - "redirect"
       rule: PathPrefix(`/`)
       service: default