GET /api/v1/repos/:owner/:name/app/notes carries an ETag and answers a repeat with 304 until a note arrives or is moderated #9244

A client's notes to their app are polled by its owner and crew; while no note arrived or was hidden, banned or unbanned, a repeat is a 304.

Done looks like:

• [x] The /app/notes GET route in src/http/api/app_notes.ts answer 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.
• [x] A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).
• [x] The etag moves when a note arrives, or one is hidden, banned or unbanned; two viewers shown different bodies never share an etag.
• [x] The 403 for a viewer who may not see the notes, and a missing app answer exactly as today, with no ETag, even with If-None-Match: *; the 304 is reached only after the access check.
• [x] test/app-notes-etag.test.ts covers each of the above, each case failing without the change.

Files: src/http/api/app_notes.ts, test/app-notes-etag.test.ts. Risks: do not touch src/http/api.ts; bodies stay byte-for-byte as they are.

Reviewed pull #9293 at its head: ticked The /app/notes GET route in src/http/api/app_notes.ts answer 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.; A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).; The etag moves when a note arrives, or one is hidden, banned or unbanned; two viewers shown different bodies never share an etag.; The 403 for a viewer who may not see the notes, and a missing app answer exactly as today, with no ETag, even with If-None-Match: *; the 304 is reached only after the access check.; test/app-notes-etag.test.ts covers each of the above, each case failing without the change..