Allow the caching of the /versions and /auth_metadata endpoints

[sandhose]

Can be reviewed commit by commit.

This sets caching headers on the /versions and /auth_metadata endpoints to:

• allow clients to cache the response for up to 10 minutes (max-age=600)
• allow proxies to cache the response for up to an hour (s-maxage=3600)
• make proxies serve stale response for up to an hour (s-maxage=3600) but make them refresh their response after 10 minutes (stale-while-revalidate=600) so that we always have a snappy response to client, but also have fresh responses most of the time
• only cache the response for unauthenticated requests on /versions (Vary: Authorization)

I'm not too worried about the 1h TTL on the proxy side, as with the stale-while-revalidate directive, one just needs to do two requests after 10 minutes to get a fresh response from the cache.

The reason we want this, is that clients usually load this right away, leading to a lot of traffic from people just loading the Element Web login screen with the default config. This is currently routed to client_readers on matrix.org (and ESS) which can be overwhelmed for other reasons, leading to slow response times on those endpoints (3s+).

Overwhelmed workers shouldn't prevent people from logging in, and shouldn't result in a long loading spinner in clients. This PR allows caching proxies (like Cloudflare) to publicly cache the unauthenticated response of those two endpoints and make it load quicker, reducing server load as well.

[MadLittleMods]

Should this be cached based on what the upstream OIDC provider tells us it should be cached for (their cache headers)?

[sandhose]

Ideally yes? But this is (always) MAS, and we control MAS, so we can assume it's MAS. The comment is misleading though, correcting that in e8cb1d20c2