Clarify Cache-Control guidance for authenticated artifact downloads

## Summary

Following a discussion with @taleodor, I’m opening this issue about the current Cache-Control guidance.

## Current guidance

The `artifact-cache-control-immutable` header currently shows an example like:

```http
Cache-Control: public, max-age=31536000, immutable
```
Artifact and signature download endpoints may require Bearer authentication. Under [RFC 9111 section 5.2.2.9](https://www.rfc-editor.org/rfc/rfc9111.html#section-5.2.2.9), public allows a shared cache to store an authenticated response.

That can lead to a CDN or proxy caching an access-controlled artifact and later serving it to another client without re-checking authorization. Immutability of a revision does not mean the response is safe to share publicly.

Start with the `artifact-cache-control-immutable` guidance and the artifact and signature download endpoint descriptions, then verify the recommendation against RFC 9111 section 5.2.2.9. Done means the specification clearly distinguishes immutable content from publicly shareable authenticated responses and gives unambiguous Cache-Control guidance.

Written by the indexing model from the issue text.