Stop browsers from caching songs

/music/rand and the other song endpoints return a different song from the
same URL, but the responses had a Last-Modified header and no Cache-Control,
so browsers cached them. The same song played again and the server never
picked a new one, so /music/addQue added nothing. Send Cache-Control:
no-store again, as the server did before the rewrite.

Also allow the Cache-Control request header in CORS, which the frontend
sends to bypass responses that browsers have already cached.

internal/server/handlers_test.go

@@ -92,6 +92,19 @@ func TestMusicQueueEndsAfterSync(t *testing.T) {
 	assert.JSONEq(t, "[]", rec.Body.String())
 }
 
+func TestMusicSongsAreNotCached(t *testing.T) {
+	e := newTestEnv(t)
+	e.addSong("Game A", "Song", "x")
+	e.do(http.MethodGet, "/api/v1/music/rand")
+	e.do(http.MethodGet, "/api/v1/music/addQue")
+	for _, path := range []string{"/api/v1/music/rand", "/api/v1/music/rand/low", "/api/v1/music/rand/classic",
+		"/api/v1/music/next", "/api/v1/music/previous", "/api/v1/music?song=0", "/api/v1/music/soundTest"} {
+		rec := e.do(http.MethodGet, path)
+		require.Equal(t, http.StatusOK, rec.Code, path)
+		assert.Equal(t, "no-store", rec.Header().Get("Cache-Control"), path)
+	}
+}
+
 func TestMusicRangeRequest(t *testing.T) {
 	e := newTestEnv(t)
 	e.addSong("Game A", "Song", "0123456789")