update default webserver response headers

[w00000dy]

This pull request updates the web server additional-headers default configuration.

• Changed the previously used proprietary Cloudflare-CDN-Cache-Control header to the RFC 9213 CDN-Cache-Control header, making it less provider-specific.

• Modified the commented-out example Content-Security-Policy header to include connect-src 'self';, which is needed by BlueMap

• Removed the "Default is none" comment because the default is not none. 😆 By default Cache-Control and CDN-Cache-Control headers are set.

[TBlueF]

Changed the previously used proprietary Cloudflare-CDN-Cache-Control header to the RFC 9213 CDN-Cache-Control header, making it less provider-specific.

This was on purpose (defensively) limited to Claudeflare since i am not sure what usecases other CDN-providers might cover and cloudflare is by far the most used provider that causes problems for most users :)
But i am open for arguments to switch this to the broader CDN-Cache-Control instead 👍

Modified the commented-out example Content-Security-Policy header to include connect-src 'self';, which is needed by BlueMap

👍 thanks

Removed the "Default is none" comment because the default is not none. 😆 By default Cache-Control and CDN-Cache-Control headers are set.

The "Default is none" comment means that: if you remove/omit that config from the config-file entirely, bluemap will fall back to set no additional header -> default behavior without config. It doesn't mean that the preconfigured value is set to no headers.
So this comment is correct and should stay :)

[w00000dy]

Thanks for the review!

The core issue isn't really Cloudflare-specific: any CDN or caching reverse proxy will look at Cache-Control: max-age=86400 and cache tiles for 24 hours, causing the exact same desync issues for users on those platforms.

Cloudflare supports CDN-Cache-Control with the exact same behavior. So there is no downside or risk of breaking anything, while generic CDN setups benefit out of the box without needing vendor-specific configurations.

So I don't see any reason why we should limit this to Cloudflare only.