Cross-visitor disclosure via header-agnostic page cache

Information disclosure in django CMS before 5.0.8 and in 5.1.0a1 allows remote attackers to expose one visitor's cached page to another via the page cache. In cms/cache/page.py, _page_cache_key omits values for headers declared by plugins through get_vary_cache_on(), so get_page_cache looks up cached content under a key that ignores those request-header values even though set_page_cache records them in Vary. Exposure requires CMS_PAGE_CACHE and a plugin that varies output on request headers such as Country-Code; under those conditions, unauthenticated attackers can poison cached responses and later visitors can receive attacker-primed or other visitors' header-specific content.