Make CdnCacheUpdate::expand() private and update the sole caller