Improve secure middleware readability and add deprecation notice

[vishr]

Summary

Improves code readability and maintainability of the secure middleware with better user guidance.

Changes:

1. Refactor HSTS header construction - Replace nested fmt.Sprintf with slice building and strings.Join for clearer logic
2. Add X-XSS-Protection deprecation notice - Document that CSP is recommended over the deprecated header
3. Clean up imports - Remove unused fmt import

Benefits:

• Cleaner, more maintainable HSTS directive building
• Better user guidance about modern security practices
• Improved code readability

Test plan

• All existing tests pass
• Linting passes
• No behavioral changes to security headers

Fixes #2799

🤖 Generated with Claude Code

[aldas]

I think all of these strings.Join(directives, "; ") calculation could be precalculated, between 109 and 110 lines

return func(next echo.HandlerFunc) echo.HandlerFunc {
// here
		return func(c echo.Context) error {