Fix logout back

[TamarW0]

Bug Description

After logout, pressing the browser's back button displayed cached authenticated pages. While the session was properly invalidated server-side (any action would redirect to login),
showing stale content was confusing and appeared insecure to users.

Fix

Strengthened cache control to no-store, no-cache, must-revalidate to prevent browsers from caching authenticated pages entirely.

[vbelouso]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[tmihalac]

Global GET filter missing Pragma and Expires headers

The PR is fixing a bug where pressing the browser's back button after
logout shows cached authenticated pages. It does two things:

1. Logout response (TokenResource.java): Adds Cache-Control: no-store,
   no-cache, must-revalidate, Pragma: no-cache, and Expires: 0 to the POST
   /user/logout response.
2. Global GET filter (application.properties): Strengthens the filter from
   Cache-Control: no-cache to Cache-Control: no-store, no-cache,
   must-revalidate for all GET responses.

The inconsistency: the three legacy headers (Pragma, Expires) were added to
the logout POST response — but that's not the page the back button shows.
The back button shows the previously visited GET pages (the dashboard,
report views, etc.). Those GET pages are covered by the global filter,
which only got the upgraded Cache-Control but NOT the Pragma and Expires
headers.

In practice, Cache-Control: no-store alone is sufficient for all modern
browsers, so the core fix works. But the Pragma: no-cache and Expires: 0
headers exist specifically for HTTP/1.0 backward compatibility. If the PR
author thought that backward compat was important enough to add them to the
logout response, they should be on the global GET filter too — that's
where the actual cached pages are served. Adding them to a POST response is
low-value since browsers almost never cache POST responses anyway.

Those are missing:

quarkus.http.filter.others.header.Pragma=no-cache
  quarkus.http.filter.others.header.Expires=0