Manager serves cacheable files with no cache headers #3434

Description

GET /api/{realm}/configuration/manager/image/{file} answers with no Cache-Control, no ETag and no Last-Modified, so every page that shows branding re-downloads the image. The realm logos are fetched on every single load, including the new Keycloak (Vaadin) login page, which is held back until the logo has painted: on a throttled connection it arrived ~750 ms after the page was otherwise ready. Keycloak serves its own theme resources with max-age=2592000 by comparison.

For that one endpoint I've made the following draft PR (...) with: @Cache(maxAge = 300, mustRevalidate = true) on the resource, the file's timestamp as Last-Modified, and request.evaluatePreconditions(...) answering 304. Short freshness because an admin can replace an image at the same URL through fileUpload.

Acceptance criteria

• An unchanged configuration image answers 304 rather than resending the body.
• Replacing an image through fileUpload shows up without a manual cache clear.
• The other endpoints that serve bytes are audited and given the same treatment where it applies. MapResource.getTile has no cache headers today either, and GET configuration/manager is fetched on every page load.
• The chosen policy is written down once, not re-decided per endpoint.