GET /api/v1/repos/:owner/:name/egress-grants carries an ETag and answers a repeat with 304 until a grant is added, used or revoked #9179

An admin's agent watching what an app may reach gets a 304 while no grant changed, so watching egress costs nothing.

Done looks like:

• [x] The route in src/http/api/egress_grants.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.
• [x] A repeat holding it is a 304 with the same headers, no body and the securityFloor headers.
• [x] Granting, revoking or a refused request that the view lists moves the etag.
• [x] A token short of admin, a non-admin and a missing repository answer as today, with no ETag, even with If-None-Match: *.
• [x] test/egress-grants-etag.test.ts covers each of the above and fails without the change.

Files: src/http/api/egress_grants.ts, test/egress-grants-etag.test.ts. Risks: do not touch src/http/api.ts or the egress proxy; this is the read only.

Reviewed pull #9184 at its head: ticked The route in src/http/api/egress_grants.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.; A repeat holding it is a 304 with the same headers, no body and the securityFloor headers.; Granting, revoking or a refused request that the view lists moves the etag.; A token short of admin, a non-admin and a missing repository answer as today, with no ETag, even with If-None-Match: *.; test/egress-grants-etag.test.ts covers each of the above and fails without the change..