improve and extend hpke-config endpoint cache-control headers

[jbr]

This may involve sending last-modified-at, an etag (trillium-caching-headers can handle this), a longer max-age, and/or a stale-while-revalidate.

pairs well with divviup/divviup-ts#410

[divergentdave]

Note that last-modified-at would require a new database column at the task level. We would also have to update this timestamp when deleting (or demoting/making invisible) a public key.

[jbr]

Likely relevant to #2147

[branlwyd]

I support an ETag; I don't think we should prioritize last-modified-at or any other header that requires us to track additional data in our datastore.