MM-31721: Fix Cache-Control directives (#16763)

We were incorrectly setting the cache control to public
when it should be rather private.

https://mattermost.atlassian.net/browse/MM-31721

```release-notes
Fix Cache-Control headers to instruct that responses may only be cached
on browsers.
```

api4/user.go

@@ -368,7 +368,7 @@ func getDefaultProfileImage(c *Context, w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%v, public", 24*60*60)) // 24 hrs
+	w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%v, private", 24*60*60)) // 24 hrs
 	w.Header().Set("Content-Type", "image/png")
 	w.Write(img)
 }
@@ -408,9 +408,9 @@ func getProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	if readFailed {
-		w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%v, public", 5*60)) // 5 mins
+		w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%v, private", 5*60)) // 5 mins
 	} else {
-		w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%v, public", 24*60*60)) // 24 hrs
+		w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%v, private", 24*60*60)) // 24 hrs
 		w.Header().Set(model.HEADER_ETAG_SERVER, etag)
 	}