Make some TransportSecurityState methods take std::string_views.

The most important of which is AddHSTSHeader(). The CL also makes the
primary caller of that function use the new
HttpResponseHeaders::EnumerateHeader() overload to avoid a string copy.

Bug: None
Change-Id: Iddb3044d059b99a6d8bd19f7ff1d4fba8683ba5b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5893454
Reviewed-by: Kenichi Ishibashi <bashi@chromium.org>
Commit-Queue: mmenke <mmenke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1361410}