Custom max-age is not respected

Hello,

if you can try to apply this patch and give a feedback would be nice.

What Changed:
The setResponseHeaders() method now respects the Cache-Control max-age directive if it's already set in the response before applying the configured TTL.

How it works now:
1. The code extracts the TTL from the configured cache settings as before
2. It checks if the response already has a Cache-Control header with a max-age directive
3. If found, it extracts the max-age value and uses it for the X-TTL header instead

After computing TTL from config, check the response's Cache-Control header for two explicit directives:

• no-store → set TTL to 0 (response must not be cached at all)
• s-maxage=N → if N is less than the configured TTL, use N instead

We deliberately check s-maxage (shared cache directive) rather than max-age, because Drupal core sets max-age=0 on all dynamic cacheable responses by default - if we respected it, nothing would ever be cached by Varnish. The s-maxage directive, on the other hand, is explicitly set by application code specifically for shared caches like Varnish.

How to use: If your endpoint needs to prevent Varnish caching (e.g. error responses, JWT failures), set Cache-Control: no-store on the response. If you need a custom TTL shorter than the module default, use s-maxage:

<?php
$response->headers->set('Cache-Control', 'public, s-maxage=300');
?>