Due to race conditions such as T47877, ResourceLoader should validate the version hash computed by the client and respond with a short max-age if its own version discovered at run-time is different.
This way, during a deployment, we will avoid polluting cache indefinitely when a not-yet-updated server responds to a new url (provided to a client by an already-updated server).
It will need to reverse engineer how the loader client concatenates and combines the version hashes (e.g. sort sha1-base64 versions by module name, and run sha1-hex).