CVE-2026-54625: django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

The CMS page cache key ignores the request headers that plugins declare via get_vary_cache_on(). The header is added to the response Vary header, but the CMS’s own cache key does not incorporate the header values, so the first visitor’s variant is served to all subsequent visitors regardless of their header values.