Surrogate cache control header is not set for 4xx responses

While this does seem like an oversight in the original implementation, this would be a backwards incompatible change for existing sites. To avoid having to create a new major version of the module, I propose we add two new settings: Surrogate 404 cache maximum age and Surrogate 5xx cache maximum age. If we keep these empty for both existing sites and new sites by default, there's no backwards compatibility break.

While we're at it, let's add the Expert mode checkbox from the Caching fieldset to this fieldset as well.

This would only apply to 4xx responses, because 5xx responses are already excluded from code above, which checks first if the original response is considered cacheable. It won't be with a 5xx code.

I'll take a look at adding this option this week...

That's a good point. It looks like the 5xx cache maximum age setting doesn't actually do anything. Even if you explicitly create a cacheable 500 response like this:

return new CacheableResponse(status: 500);

there's Drupal\Core\PageCache\ResponsePolicy\NoServerError who marks the request as non-cacheable. I'll create another issue to remove that setting.