GET /api/v1/cloud/accounts carries an ETag and answers a repeat with 304 until a cloud account or its use changes #9206

The client-forge setup reads cloud accounts on each visit; a repeat with no account change is a 304.

Done looks like:

• [x] The /api/v1/cloud/accounts route in src/http/api/cloud.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.
• [x] A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).
• [x] The etag moves when an account is linked or removed, or a repository starts or stops using a vendor; two viewers who are shown different bodies never share an etag.
• [x] No session, a read-only token (403) and a non-admin (404) answer exactly as today, with no ETag, even with If-None-Match: *; the 304 is reached only after the access check.
• [x] test/cloud-accounts-etag.test.ts covers each of the above and fails without the change.

Files: src/http/api/cloud.ts, test/cloud-accounts-etag.test.ts. Risks: do not touch src/http/api.ts; the body stays byte-for-byte as it is.

Reviewed pull #9235 at its head: ticked The /api/v1/cloud/accounts route in src/http/api/cloud.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.; A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).; The etag moves when an account is linked or removed, or a repository starts or stops using a vendor; two viewers who are shown different bodies never share an etag.; No session, a read-only token (403) and a non-admin (404) answer exactly as today, with no ETag, even with If-None-Match: *; the 304 is reached only after the access check.; test/cloud-accounts-etag.test.ts covers each of the above and fails without the change..