feat: retry azul apis only when retry-after value is specified (#4561)

[hunterckx]

Re: #4561

Needs Findable update including the changes from DataBiosphere/findable-ui#1123

anvil-cmg, hca-dcp, and lungmap are given a Ky config that prevents retrying on responses that lack a value in the Retry-After header.

Note: For the sake of running it in Jest, Ky is added to the transpiled packages in the Next config

[NoopDog]

Thanks Hunter, this matches what Azul asked for in #4561: only retry Azul requests whose response carries a Retry-After header. Errors without it, including 400, 500, 502 and 504, now fail straight away, and requests with it wait the header's delay and retry up to 3 times. Putting it behind kyOptions, so only the Azul sites change, is nice and tidy, and the new tests fail against the old behaviour, so they're doing their job.

Approving the policy. A few things before this ships:

1. Bump findable-ui once #1123 is released. CI is red until then, because 57.0.0 doesn't have kyOptions.
2. Check Azul prod before the prod release. As of Azul's Oct 6 comment, Access-Control-Expose-Headers is only live in the lower deployments. If prod doesn't expose Retry-After when this ships, the browser can't see the header, and prod stops retrying 429s and 503s entirely.
3. One question for Azul: do API Gateway's own 502 and 504 responses include CORS headers? Those errors come from the Gateway, not Azul's code (504 timeouts, 502 "payload too large"). If they arrive without CORS headers, the browser hides them and fetch reports a plain network error, which Ky still retries (1s/3s/9s). That would retry exactly the 502s and 504s Hannes said not to. If they do have CORS headers, this PR is right as it is. If not, the cleaner fix is on Azul's side.
4. 307 with Retry-After. The browser follows a 307 immediately and doesn't wait for the header's delay. Azul's #7452 was going to test this against a local Data Browser, so it's worth confirming that immediate follow-up is fine with them.
5. Small: the PR body says "Re: #4561". If this finishes the issue, "Closes #4561" will close it on merge. Optionally, the two checks in constants.ts can be one isHTTPError(error) && !error.response.headers.get("Retry-After") ? false : undefined, and the empty-string Retry-After test covers a value Azul won't send.

Dismissing my approval until the findable-ui bump lands, since this repo doesn't require green checks to merge. The feedback above still stands, and I'll re-review after the bump.