perf(core): allow versioned avatar URLs to be cached for 30 days

[pringelmann]

• Resolves: Improve avatar management to reduce load during large Talk calls #61726

Summary

Avatar URLs can now carry a ?v= version. With it, the response is cached for 30 days instead of 1.

The 1 day TTL means avatars get revalidated constantly, and a 304 here costs nearly as much as a 200 because the time goes into PHP bootstrap, not on sending the image itself. A big Talk call is a few hundred of those.

The version is bumped on avatar upload/removal, avatar scope changes, and enable/disable. Avatars that depend on who's asking (v2-private) keep the 1 day window, since one URL serves different bytes to different viewers.

?v= only widens the cache window, it never picks the image. A stale version still returns the current avatar.

Nothing sends it yet, so this is a no-op alone. Talk and @nextcloud/vue follow separately.

Trade-off

A bump only changes future URLs, it can't reach a cache that's already populated. So a deleted account's avatar can now linger in a browser for a month instead of a day. Same for one switched to v2-private. 7 days also works if there are privacy concerns.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI