Static assets answer 304 to a matching ETag and immutable ones are cached for a year #2718

Fourth part of #2675.

Done:

• [ ] every static asset (src/web/asset.ts) sends a strong ETag; If-None-Match answers 304 with no body
• [ ] content-hashed assets send Cache-Control: public, max-age=31536000, immutable; nothing else does
• [ ] the security headers stay on 304s
• [ ] tests for both, and that an HTML page is never marked immutable