HTTP caching: Cache-Control, ETag, and conditional requests

[krokicki]

Makes x2s3 responses cacheable and revalidatable, so viewers like Neuroglancer and N5 Viewer stop refetching bytes they already have.

What this adds

• Cache-Control, ETag, and an RFC 7231 Last-Modified on file- and S3-backed objects.
• Conditional requests: If-None-Match / If-Modified-Since are answered with 304 on GET and HEAD.
• If-Range handling, so a resumed download against a file that changed underneath gets the full new representation instead of two versions stitched together.
• nginx is no longer told to hide Cache-Control, so the policy reaches browsers and shared caches.

Review fixes included

A review of the branch turned up several issues, each fixed with a failing test first:

Fix	Problem
Conditionals before 416	An unsatisfiable Range short-circuited conditional handling, so a client resuming a download of a file that had shrunk got a permanent 416 instead of a 304 or the full body (RFC 9110 13.2.2).
nginx conditional headers	proxy_cache makes nginx replace the client's If-None-Match/If-Modified-Since with its own revalidation values, which made the new 304 support unreachable behind the production nginx. Restored for cache-bypassed (ranged) requests only — forwarding them on cached requests would let a client's ETag answer nginx's revalidation and mark a stale entry fresh.
Origin Cache-Control	Every S3-backed response was stamped public, max-age=3600, overriding an origin no-store or private. The default now applies only to objects carrying no policy.
S3 conditional forwarding	Revalidation opened a full upstream GetObject and discarded the body, so a viewer revalidating thousands of chunks cost nearly as much as never having cached them. IfNoneMatch/IfModifiedSince are now forwarded and S3's 304 translated.
Locale-safe Last-Modified	strftime('%a, %d %b %Y ...') expands month names using the process locale, producing an unparseable date under a non-C locale and silently killing revalidation.
If-None-Match: *	Never matched on targets that don't proxy ETags (the proxy_etag=False default), because the empty-ETag guard ran before the * check.
ETag parsing	If-None-Match was split on bare commas, cutting quoted ETags that legally contain one.
no-cache bypass	Pre-existing: a location-level proxy_cache_bypass replaces the http-level one rather than adding to it, so including proxy_cache.conf silently dropped the Cache-Control: no-cache bypass in both locations.

Testing

134 tests pass, including the network tests against the real janelia-data-examples bucket.

New coverage includes tests/test_nginx_cache_headers.py, which runs real nginx in front of an echo upstream and asserts on the headers that actually arrive — nginx's header substitution is invisible from either end alone. It skips automatically when no nginx binary is present.

Verified beyond the suite:

• End-to-end through real nginx + x2s3, a ranged conditional GET returns 206 before the nginx fix and 304 after.
• Real S3 evaluates conditionals before Range (unsatisfiable range alone → 416; with a matching validator → 304), matching the ordering now implemented for the file backend, so both backends agree.
• The production nginx.conf still passes nginx -t.
• The active fileglancer repo consumes FileProxyClient.open_object positionally; the added parameters are optional and appended, so that call still binds (checked directly).

@StephanPreibisch @JaneliaSciComp/fileglancer @neomorphic