Remove Jobname/Jobid/Node headers, add nosniff for static files

[mgrossmann]

Fixes #209

What

• httpresp() no longer emits Jobname:, Jobid: and Node: — no response identifies the address space any more, authenticated or not. A comment at the former emission site records why, so they do not quietly come back.
• Static files served from the DOCROOT now carry X-Content-Type-Options: nosniff (emitted in httpget.c right after Content-Type, so the SSI path is covered too). mvsMF already sends it on its own responses (Harden the session cookie, align the /zosmf/info payload, and write the common headers once mvsmf#327); this closes the gap for the Desktop assets served by httpd itself.
• httprlm.c's comment and docs/auth-redesign.md no longer cite the removed Node: header as the precedent for the SMF-ID realm. The realm itself is untouched — it reads __smfid() directly.

Why removal (option 3) is safe

Scanned every repo under the ecosystem root — shell/Python/JS/REXX/C, test suites, deploy tooling, docs — for consumers of the three headers and for header-reading patterns generally:

• All jobname/jobid hits in mvsmf/tests/curl-jobs.sh, mbt/scripts/mbt/mvsmf.py and the docs are jobs-API JSON fields (jq -r '.jobid', resp.get("jobname")), unaffected by this change.
• The mvsMF Desktop reads exactly one response header: ETag (datasets.js).
• httpd's shutdown test scripts use JOBNAME only as an environment variable for console commands.
• The debugging workflows identify the answering instance by port and by jobid from the MTT/jobs API, not from these headers.

Verification

• make modules clean (cc370, -Wall -Werror)
• make test-host: 6 tests, 98 assertions, 0 fail

Not covered by an automated test: header emission needs a socket, so the header set itself is only checkable against a live instance (curl -s -i on any path — the three headers must be absent, static files must show X-Content-Type-Options: nosniff).