fix(server): restore cache response signatures

Summary

• Restore x-tuist-signature on central Tuist cache responses when the request carries a cache hash.
• Add controller coverage for signed cache download and cache action item responses.

Why

Zillow reported cache downloads failing with Invalid or missing signature from cache server. CLI 4.193.4 still verifies cache responses with SignatureVerifierMiddleware, but PR #10899 removed response signing from the central cache controller. Unsigned responses are rejected by those clients even when the cache artifact itself is valid.

Root Cause

The central Tuist cache API stopped emitting x-tuist-signature for hash-addressed cache responses while signed-response clients were still in use.

Validation

• mix test test/tuist_web/controllers/api/cache_controller_test.exs
• git diff --check HEAD~1