feat: add ETag and full RFC 9110 conditional request support

[kaiburjack]

Since GCS computes ETags for all objects, we can add conditional HTTP requests support for ETag/If-None-Match and allow also potentially re-uploaded but identical (identical content hash, ETag) to be responded with 304 and cached by intermediary proxies/caches/CDNs.

Emit the GCS object etag as the ETag header on all object responses and evaluate the complete precondition set for this GET/HEAD proxy:

• If-None-Match (weak comparison, lists, "*") → 304; when present, If-Modified-Since is ignored as RFC 9110 requires
• If-Match / If-Unmodified-Since → 412 Precondition Failed
• If-Range: strong etag or exact Last-Modified date, otherwise the Range header is ignored and the full body served - a resumed download can no longer mix bytes from two object versions
• All three HTTP-date formats; invalid dates, malformed entity-tags, and empty conditional headers are ignored per net/http semantics

Preconditions run before Range processing and also cover default-index, walk-up, and SPA fallback responses (against the resolved object's etag); the -not-found 404 page is never conditional.

Gzip-stored objects get a weak W/"..." etag plus Vary: Accept-Encoding, since the same URL serves raw-gzip or GCS-transcoded bytes depending on the request's Accept-Encoding.

Also fixed:

• 304 responses now carry ETag/Last-Modified/Cache-Control instead of a bare status line
• objects with unknown (zero) Updated no longer answer 304 to any If-Modified-Since; date conditionals are disabled for them
• reads are pinned to the generation the validators came from, so a concurrent overwrite cannot pair a new body with stale validators