Add properties to set additional security headers

Spring Security normally sets the X-XSS-Protection and Strict-Transport-Security HTTP response headers by default. Add system properties to allow an administrator to control setting these headers in GeoServer.