`isCacheable` allowed cache by default if the `cache-control` header is empty may leading to a security flaw in ssg content

Nobody has claimed this yet.

This problem appeared in [@sveltejs/adapter-cloudflare@2.2.2](https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fadapter-cloudflare%402.2.2) that let `Cache.save` handle whether to cache the response or not.

The scenario that leads to the problem is when [`Cache-Control` is empty](https://github.com/lukeed/worktop/blob/master/src/cache.ts#L37-L38) and the user is logged in without any problem all the content is generated and cached to the CF server. Then another tries to access directly to the dashboard without any authorization CF server response cached content of another user directly to them.

I think that we should not allow cache by default and let the developer decide which response to cache to avoid this issue.

Start with Cache.save and the referenced src/cache.ts behavior for an empty Cache-Control header. Confirm how cacheability is decided when the header is empty, then define completion as preventing caching by default while preserving an explicit developer choice for responses that should be cached.

Written by the indexing model from the issue text.