🐛 Do not cache the environment generated config.js (#11146)

On self hosted installs /js/config.js is regenerated from PENPOT_FLAGS
on every container start, but nginx served it with the same
`public, max-age=604800` used for build assets, and index.html versions
it only by the build. A flags only change therefore leaves the URL
untouched, so a browser that had already loaded the app kept using its
cached copy for up to a week: enabling a flag such as
enable-login-with-google had no visible effect for returning users
until the cache expired or they cleared their site data.

Serve that one file with the same no-store headers already used for
index.html, which is the other file whose contents change without its
URL changing. Every other static asset keeps the long lived cache.

Fixes #10556.

Signed-off-by: Filip Sajdak <filip.sajdak@siili.com>
Co-authored-by: Andrey Antukh <niwi@niwi.nz>

docker/images/files/nginx.conf.template

@@ -161,6 +161,16 @@ http {
         location / {
             include /etc/nginx/overrides/location.d/*.conf;
 
+            # Regenerated from the environment on every container start
+            # (see nginx-entrypoint.sh) while its URL is only versioned by
+            # the build, so a flags only restart leaves the URL untouched.
+            # Caching it like a build asset would keep returning users on
+            # the previous PENPOT_FLAGS for up to a week.
+            location = /js/config.js {
+                include /etc/nginx/nginx-security-headers.conf;
+                add_header Cache-Control "no-store, no-cache, max-age=0" always;
+            }
+
             location ~* \.(js|css|jpg|png|svg|gif|ttf|woff|woff2|wasm|map)$ {
                 include /etc/nginx/nginx-security-headers.conf;
                 add_header Cache-Control "public, max-age=604800" always; # 7 days