628571fc79
Rails' ActiveStorage proxy controllers hardcode `http_cache_forever public: true`, which sets `Cache-Control: public, immutable`. For non-public blobs behind auth, this allows CDN caching that serves responses without authorization checks. Override `http_cache_forever` in the Authorize concern to downgrade `public` to `false` for non-public blobs. See https://github.com/basecamp/fizzy/pull/2251 for context