Improve secure middleware readability and add deprecation notice

[vishr]

Summary

Improves code readability and maintainability of the secure middleware with better user guidance.

Changes:

1. Refactor HSTS header construction - Replace nested fmt.Sprintf with slice building and strings.Join for clearer logic
2. Add X-XSS-Protection deprecation notice - Document that CSP is recommended over the deprecated header
3. Clean up imports - Remove unused fmt import

Benefits:

• Cleaner, more maintainable HSTS directive building
• Better user guidance about modern security practices
• Improved code readability

Test plan

• [x] All existing tests pass
• [x] Linting passes
• [x] No behavioral changes to security headers

Fixes #2799

🤖 Generated with Claude Code