perf: load public raw apps without the loading screen (#11608)

* perf: load public raw apps without the loading screen

* fix: keep license store and drop stale prefetches on public app pages

* fix: answer raw app requests with an error when the job bridge fails to load

---------

Co-authored-by: Ruben Fiszel <ruben@windmill.dev>

backend/windmill-api/src/apps.rs

@@ -979,7 +979,14 @@ async fn get_raw_app_data(
             // the opaque, sandboxed wrapper (incl. under a cross-origin-isolated
             // / COEP `require-corp` embedder).
             .header("X-Content-Type-Options", "nosniff")
-            .header("Cross-Origin-Resource-Policy", "cross-origin");
+            .header("Cross-Origin-Resource-Policy", "cross-origin")
+            // The secret names one app version, whose bundle is written once at deploy,
+            // so the URL's content never changes. `private`: the URL is a capability, so
+            // shared caches must not keep serving it after the app is deleted.
+            .header(
+                http::header::CACHE_CONTROL,
+                "private, max-age=31536000, immutable",
+            );
         Ok(res.body(body).unwrap())
     } else {
         return Err(Error::NotFound("File not found".to_string()));