Cross-user disclosure via forced public caching

Exposure of cached authenticated content in Catalyst::Plugin::Static::Simple through 0.38 lets remote attackers read cached user responses. In lib/Catalyst/Plugin/Static/Simple.pm, _serve_static unconditionally wrote Cache-Control: public and ignored an expires value of 0, so shared proxies were told to store and reuse responses that should have remained private or uncached. Exposure requires a deployment path with a shared intermediary cache and reachable static responses tied to one user's authenticated session; the published record describes cross-user disclosure, not response tampering or service interruption.