CacheControlOverrideSubscriber overrides unrelated Cache-Control directives

Problem/Motivation

If the response contains Cache-Control directives not manipulated by cache_control_override (like no-transform), they are deleted because CacheControlOverrideSubscriber replaces the whole Cache-Control header.

Steps to reproduce

Here is a controller that reproduces the problem:

namespace Drupal\cco_test\Controller;

use Drupal\Core\Controller\ControllerBase;
use Drupal\Core\Render\HtmlResponse;

/**
 * Test controller
 */
class TestController extends ControllerBase {

  /**
   * @return \Drupal\Core\Render\HtmlResponse
   */
  public function test(): HtmlResponse {
    $response = new HtmlResponse('foo');
    $response->setPublic();
    $response->setMaxAge(42);
    $response->getCacheableMetadata()->setCacheMaxAge(42);
    $response->headers->addCacheControlDirective('no-transform');

    return $response;
  }

}

But a more likely scenario would be an event subscriber that runs between FinishResponseSubscriber and CacheControlOverrideSubscriber and adds new Cache-Control directives.

Proposed resolution

Instead of using ResponseHeaderBag::set(), this module should probably use HeaderBag::addCacheControlDirective() and Response::setPublic().