apply freshness checks to redirects with explicit expiration

[ogalland-tob]

CacheControl treats stored 301 and 308 responses as permanently reusable. It returns them before evaluating response freshness or cache-control directives.

This is a bit tricky, but RFC 9111 section 4.2.2 states:

A cache MUST NOT use heuristics to determine freshness when an explicit expiration time is present in the stored response. Because of the requirements in Section 3, heuristics can only be used on responses without explicit freshness whose status codes are defined as "heuristically cacheable" (e.g., see Section 15.1 of [HTTP]) and on responses without explicit freshness that have been marked as explicitly cacheable (e.g., with a public response directive).

If we take cachecontrol's heuristic to be "the response is permanently fresh" then (afaiu) this would mean that redirect responses with explicit expiration dates can expire and thus should be checked for freshness (i.e., the explicit expiration takes precedence over the heuristic).

This PR applies the usual freshness checks to redirects, and introduces a fallback to still treat them as permanently fresh if the response is not expired. It also introduces relevant unit tests.

[woodruffw]

Thank you @ogalland-tob! Seems right to me.