Deal properly with header response

Fixes the current issue with the new collection listing endpoint [1]. Checking the docs [2], it was badly done so far.

This also fixes other inappropriately set or get response headers in the deposit code base (both production and tests).

• [1] https://sentry.softwareheritage.org/share/issue/919e0881b3094bcdbf112131615ac05f/

• [2] https://docs.djangoproject.com/en/2.2/ref/request-response/#setting-headers

Related to #2996 (closed)

Test Plan

tox

Hot fix in staging instance and it's fine (see swh/meta$1047)

---

Migrated from D5783 (view on Phabricator)