Server function responses ship no Cache-Control, and a CSRF Vary that defeats GET caching #3071

Describe the bug

Two defaults pull server function responses in the wrong direction: responses that must not be
cached carry nothing that says so, and responses that exist to be cached carry a Vary that
prevents it.

1. No Cache-Control on any response. encodeResult
(packages/web/server-functions/src/server.ts:1290-1331 on next) sets Content-Type and the
format header; the only no-store in the file is on the 403 path (server.ts:1475). The docs
present caching as opt-in via respond(data, { headers: { "cache-control": … } }), but on the
wire nothing marks the default as uncacheable, and CDN zones with override-TTL or "cache
everything" rules (Bunny, Cloudflare Cache Rules) will store per-user responses.

2. Every response carries Vary: Sec-Fetch-Site, Origin, Referer from the same-origin gate
(server.ts:1444-1469, applied at 1864) — including successful GET responses from
GET(fn)-declared functions. Those three headers are exactly the ones that differ between a
navigation and a fetch, and Referer is per-page, so a shared cache fragments per referring
page. CDNs that honor Vary only for Accept-Encoding (Cloudflare) ignore it and serve one
entry across every context instead, which is the worse failure.

Steps to reproduce

mkdir sf-repro && cd sf-repro && npm init -y
npm i @solidjs/web@2.0.0-rc.3          # pulls solid-js@2.0.0-rc.3
node --conditions=development repro.mjs  # the dev condition only makes the error text readable

repro.mjs:

import { GET, configureServerFunctionsServer, createServerReference, handleServerFunctionRequest, registerServerReference } from "@solidjs/web/server-functions";
import { provideRequestEvent } from "@solidjs/web/storage";

configureServerFunctionsServer({ provideEvent: (event, run) => provideRequestEvent(event, run) });
GET(createServerReference(registerServerReference("pub-0", async () => ({ who: "public menu" }))));

const res = await handleServerFunctionRequest(
  new Request("http://app.test/_server?id=pub-0", { headers: { "Sec-Fetch-Site": "same-origin" } })
);
console.log(res.status, JSON.stringify(Object.fromEntries(res.headers)));

Output on @solidjs/web@2.0.0-rc.3:

200 {"content-type":"application/json","vary":"Sec-Fetch-Site, Origin, Referer","x-server-function-format":"8"}

Expected behavior

• Emit Cache-Control: no-store unless the function set its own, so caching is opt-in on the
  wire the way the documentation describes it in prose.
• Don't attach the CSRF Vary to responses from GET-declared functions (or make the gate
  opt-out per function). A cross-site GET cannot read the response body — that is what CORS
  enforces — and SameSite governs the ambient credentials, so for a declared read the gate
  buys little and costs the caching the helper exists for.

Environment