internal/ctlog: set no-cache for ETag backend Gets

Otherwise the Get at startup might be cached and then fail the If-Match.

internal/ctlog/ctlog.go

@@ -207,6 +207,7 @@ func LoadLog(ctx context.Context, config *Config) (*Log, error) {
 	if c1.N < c.N {
 		// It's possible that we crashed between committing a new checkpoint to
 		// the lock backend and uploading it to the object storage backend.
+		// Or maybe the object storage backend GETs are cached.
 		// That's ok, as long as the rest of the tree load correctly against the
 		// lock checkpoint.
 		config.Log.WarnContext(ctx, "checkpoint in object storage is older than lock checkpoint",

internal/ctlog/etag.go

@@ -86,6 +86,8 @@ func (b *ETagBackend) Fetch(ctx context.Context, logID [sha256.Size]byte) (Locke
 	out, err := b.client.GetObject(ctx, &s3.GetObjectInput{
 		Bucket: aws.String(b.bucket),
 		Key:    aws.String(key),
+	}, func(options *s3.Options) {
+		options.APIOptions = append(options.APIOptions, awshttp.AddHeaderValue("Cache-Control", "no-cache"))
 	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to fetch %q from ETag backend: %w", key, err)