CVE-2026-113593: Potential exposure of private data via empty and missing `Vary` headers

`UpdateCacheMiddleware` and `cache_page()` generated the same cache key

for a request that omitted a header listed in the response's `Vary` header
and a request that sent that header with an empty value. As a result, a
response cached for one of these requests could be served to the other, which
could lead to the exposure of private data.

Cache keys now distinguish between absent and empty header values, as required
by [RFC 9111#section-4.1](https://datatracker.ietf.org/doc/html/rfc9111.html#section-4.1).

Responses previously cached for requests that omitted a header listed in
`Vary` will no longer be matched, and will be cached again on the next
request.

This issue has severity "low" according to the [Django security policy](https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels).

Thanks to Andrew Gonzalez for the report.