Fixes the current issue with the new collection listing endpoint [1]. Checking
the docs [2], it was badly done so far.
This also fixes other inappropriately set or get response headers in the deposit code
base (both production and tests).
[1] https://sentry.softwareheritage.org/share/issue/919e0881b3094bcdbf112131615ac05f/
[2] https://docs.djangoproject.com/en/2.2/ref/request-response/#setting-headers
Related to T2996