Add cache headers to responses

[alxndrsn]

Resubmission of #1390

---

Closes getodk/central#662

What has been done to verify that this works as intended?

Added tests.

Why is this the best possible solution? Were any other approaches considered?

It seems simple.

An alternative approach was tried in #1390, but it was decided that content should be cached for less time.

This PR also adds more extensive tests which were not present in #1390.

Previously, max-age=0 was being used, to ensure that any cached values were immediately considered stale. This has been changed to no-cache, which allows caching but requires revalidation on every use. See:

• https://httpwg.org/specs/rfc9111.html#cache-response-directive.max-age
• https://httpwg.org/specs/rfc9111.html#cache-response-directive.no-cache

How does this change affect users? Describe intentional changes to behavior and behavior that could have accidentally been affected by code changes. In other words, what are the regression risks?

Should prevent future caching surprises.

Does this change require updates to the API documentation? If so, please update docs/api.yaml as part of this PR.

No? "cache" is not currently mentioned in docs/

Before submitting this PR, please make sure you have:

• run make test and confirmed all checks still pass OR confirm CircleCI build passes
• verified that any code from external sources are properly credited in comments or that everything is internally sourced

[alxndrsn]

This could be reduced to testing a single URL.

[sadiqkhoja]

Looks good

[alxndrsn]

@lognaturel I think there's an argument for setting Cache-Control: no-store on all API responses: this PR's current default of Cache-Control: private, no-cache will allow storage of responses in browsers' local cache. For single-user devices this is probably not an issue, but for shared devices this potentially means that central response content and headers will be stored on disk.