Added the HPKP report-uri setting to the WordPress Security headers module.

Found a silly bug for the HPKP max-age setting, thanks to using Scott Helme’s report-uri analysis tool during testing.