Function apply_security_response_headers 

pub fn apply_security_response_headers(
    header: &mut ResponseHeader,
    is_https: bool,
)

Inject baseline security headers onto a response.

Notes:

• Uses “set-if-missing” to avoid overriding application-owned policies.
• HSTS is only injected when the downstream request is HTTPS.