fix: isolate response header values

[linkdata]

Closes #173

Summary

• emit Cache-Control, Allow, and tail-script Content-Type through http.Header.Set
• replace mutable package-level header slices with immutable string constants
• verify sequential and concurrent response header ownership under the race detector

Testing

• go generate ./...
• go test -race ./...
• go vet ./...
• go build ./...
• staticcheck ./...
• golangci-lint run ./...
• gosec ./...