Evidence highlight is not always accurate

Describe the bug
When scanning a host with ZAP that has HSTS enabled, ZAP mistakes the max-age of the HSTS header with Cache-Control.

To Reproduce
Scan a host that has the following header set:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

1. Open ZAP
2. Click on Quick Start
3. Choose Automated scan
4. Enter the URL of the target that uses HSTS (the above header)
5. Click Attack
6. Wait for the scan to finish
7. Go to the Alerts tab
8. Look for "Incomplete or No Cache-control Header Set" and click it
9. In the details, you should see Parameter: Cache-Control, Evidence: max-age=31536000 but this is not Cache-Control!

Expected behavior
It should not interpret Strict-Transport-Security (HSTS) as Cache-Control.

Screenshots

Software versions

• ZAP: 2.10.0
• Add-on: I did not install any addons from the marketplace, I just have the standard addons (which I updated):

Installed Add-ons: [[id=alertFilters, version=10.0.0],
[id=ascanrules, version=40.0.0], [id=bruteforce,
version=10.0.0], [id=commonlib, version=1.4.0], [id=diff,
version=10.0.0], [id=directorylistv1, version=4.0.0],
[id=domxss, version=10.0.0], [id=encoder, version=0.5.0],
[id=formhandler, version=3.0.0], [id=fuzz, version=13.2.0],
[id=gettingStarted, version=12.0.0], [id=graaljs,
version=0.1.0], [id=graphql, version=0.3.0], [id=help,
version=11.0.0], [id=hud, version=0.12.0], [id=importurls,
version=7.0.0], [id=invoke, version=10.0.0], [id=onlineMenu,
version=8.0.0], [id=openapi, version=18.0.0],
[id=pscanrules, version=34.0.0], [id=quickstart,
version=29.0.0], [id=replacer, version=8.0.0], [id=retire,
version=0.7.0], [id=reveal, version=3.0.0],
[id=saverawmessage, version=5.0.0], [id=savexmlmessage,
version=0.1.0], [id=scripts, version=28.0.0], [id=selenium,
version=15.3.0], [id=soap, version=7.0.0], [id=spiderAjax,
version=23.3.0], [id=tips, version=8.0.0],
[id=webdrivermacos, version=29.0.0], [id=websocket,
version=23.0.0], [id=zest, version=34.0.0]]

• OS: macOS 11.4 "Big Sur" (formerly Mac OS X)
• Java: Bundled in App is "jre-jdk8u275-b01-jre" "AdoptOpenJDK 1.8.0_275" ("1.8.0_275")
• Browser: N/A

Errors from the zap.log file
N/A

Additional context
N/A

Would you like to help fix this issue?
Let me know if you need more information.

Start by reproducing the scan with the provided Strict-Transport-Security header and inspect the "Incomplete or No Cache-control Header Set" alert in the Alerts tab. Trace how that alert produces its Parameter and Evidence values; it is done when HSTS max-age is no longer reported as Cache-Control and the alert still handles genuine Cache-Control cases correctly.