adding security headers in wso2am-4.0.0 (sts & csp & referer headers)

I'm trying to add those two headers in all portals as guided by my companies security team. So far I've tried adding somem configurations in the deployment.toml. This only brings the sts header in the devportal but not in other portals.

[[tomcat.carbon.filter]]
name = "HttpHeaderSecurityFilter"
class = "org.apache.catalina.filters.HttpHeaderSecurityFilter"
init_param_name = "hstsMaxAgeSeconds"
init_param_value = "15768000"

[[tomcat.carbon.filter_mapping]]
name = "HttpHeaderSecurityFilter"
url_pattern = ["*"]

I've also tried adding the filters in the web.xml file that is available here: wso2am-4.0.0/repository/conf/tomcat/carbon/WEB-INF but this configurations seem to be rewritten on startup.

[2024-04-29 16:13:46,247]  INFO {org.wso2.config.mapper.ConfigParser} - Configurations Changed in :repository/resources/security/sslprofiles.xml
[2024-04-29 16:13:46,249]  INFO {org.wso2.config.mapper.ConfigParser} - Configurations Changed in :repository/resources/security/listenerprofiles.xml
[2024-04-29 16:13:46,249]  INFO {org.wso2.config.mapper.ConfigParser} - Configurations Changed in :repository/conf/deployment.toml
[2024-04-29 16:13:46,250]  INFO {org.wso2.config.mapper.ConfigParser} - Configurations Changed in :repository/conf/tomcat/carbon/WEB-INF/web.xml

Anyone know how I could solve this?

Try adding these

[[tomcat.filter]]
name = "httpHeaderSecurity"
class = "org.apache.catalina.filters.HttpHeaderSecurityFilter"
async_supported = true

[tomcat.filter.init_params]
hstsEnabled = true
hstsMaxAgeSeconds = 31536000
hstsIncludeSubDomains = true

[[tomcat.filter_mapping]]
name = "httpHeaderSecurity"
url_pattern = "/*"
dispatchers = "REQUEST"