chore: add cache headers

[vwong]

We want to avoid clients from accidentally caching these, so let's tell them not to!

[bethesque]

Remember to put the ticket number in the commit!

[bethesque]

This is user facing, so I've squash merged it as a feat: rather than a chore:.

[bethesque]

So, I shouldn't have merged this, because where this has been inserted into the middleware stack will cause it to disable cache for ALL resources, not just API resources. It means that static assets now don't get cached.

Can you move it after the @app_builder.use Rack::Static... lines please?

[bethesque]

So, the React UI uses these headers for the index page.

        "Cache-Control" => "no-cache, no-store, must-revalidate",
            "Pragma" => "no-cache",
            "Expires" => "0",
            "Vary" => "Accept, Accept-Encoding"

Should we be using all of those do you think?