Allow a resource Cache-Control HTTP header to be private

[renaudclosset]

Q	A
Bug fix?	no
New feature?	yes
BC breaks?	no
Deprecations?	no
Tickets
License	MIT
Doc PR

This change allows to mark a resource as "private" in the cache headers, to avoid having it being cached by shared caching services (Varnish, etc.)

Example:
User resources (/api/user/xxx) may contain sensitive information that cannot be controlled fine-grained enough with a Vary-header. So these resources should only be cached on the client.

Configuration:

resources:
  App\Entity\User:
    attributes:
      cache_headers:
        public: false
        shared_max_age: 0 # <- this is ignored as not relevant on private resources

[dunglas]

Good catch, thanks for the fix!