GET /api/v1/repos/:owner/:name/forks carries an ETag and answers a repeat with 304 until a fork is made, pushed or hidden, or the parent moves #9168

An agent or page watching a fork family gets a 304 while no fork and no parent tip moved, instead of re-reading every fork's drift.

Done looks like:

• [x] The forks route in src/http/api/upstream.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.
• [x] A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).
• [x] The etag moves when a fork is created or deleted, when a fork is pushed, and when the parent's default branch moves; a different limit or cursor gets a different etag.
• [x] A viewer who cannot see a private fork never shares an etag with one who can.
• [x] A 404 or a bad page parameter carries no ETag.
• [x] test/forks-etag.test.ts covers each of the above and fails without the change.

Files: src/http/api/upstream.ts, test/forks-etag.test.ts. Risks: do not touch src/http/api.ts; the body stays as it is. Computing the etag from the body still reads drift; a cheaper key is welcome but not required.

Reviewed pull #9172 at its head: ticked The forks route in src/http/api/upstream.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.; A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).; The etag moves when a fork is created or deleted, when a fork is pushed, and when the parent's default branch moves; a different limit or cursor gets a different etag.; A viewer who cannot see a private fork never shares an etag with one who can.; A 404 or a bad page parameter carries no ETag.; test/forks-etag.test.ts covers each of the above and fails without the change..