Handling of max-age from PyPI

[pelson]

There is a long and chequered history of max-age handling... notably:

• pip completely ignores it (based on discussion from Local HTTP cache is confusing for package maintainers pypa/pip#5670)
• uv honours it (resulting in a 2-8x speed-up, and a few issues)
• Note that apparently warehouse notifies Fastly when a release of a project is made, in order to invalidate the CDN cache

What should simple-repository-server do? My feeling is that it should probably honour the max-age header. I would probably support a specific way to invalidate the cache when we know it is no longer correct (e.g. because there was an upload) - there is nothing standards-based (http standards) to support this, AFAIK.

[pelson]

We should probably just use https://hishel.com/userguide/ for following the caching RFCs to the letter. We can always override max-age cache if we care about always getting the most fresh content (like pip does). cc @ivany4