Fixes the current issue with the new collection listing endpoint [1]. Checking
the docs [2], it was badly done so far.

This also fixes other inappropriately set or get response headers in the deposit code
base (both production and tests).

[1] https://sentry.softwareheritage.org/share/issue/919e0881b3094bcdbf112131615ac05f/

[2] https://docs.djangoproject.com/en/2.2/ref/request-response/#setting-headers

Related to T2996

tox

Hot fix in staging instance and it's fine (see P1052)