Set cache-control for replacement attachment redirects

These currently return a 301 with Cache-Control set to private (because
that's the default unless otherwise specified).  This means that these
requests can't be cached in the CDN etc.

This sets a cache-control header to the default `uploads_cache_max_age`.