MM-31721: Fix Cache-Control directives (#16763)

We were incorrectly setting the cache control to public
when it should be rather private.

https://mattermost.atlassian.net/browse/MM-31721

```release-notes
Fix Cache-Control headers to instruct that responses may only be cached
on browsers.
```

api4/compliance.go

@@ -130,7 +130,7 @@ func downloadComplianceReport(c *Context, w http.ResponseWriter, r *http.Request
 
 	c.LogAudit("downloaded " + job.Desc)
 
-	w.Header().Set("Cache-Control", "max-age=2592000, public")
+	w.Header().Set("Cache-Control", "max-age=2592000, private")
 	w.Header().Set("Content-Length", strconv.Itoa(len(reportBytes)))
 	w.Header().Del("Content-Type") // Content-Type will be set automatically by the http writer