GHSA-m2w3-8f23-hxxf: Caddy's vars_regexp double-expands user input, leaking env vars and files

Caddy's `vars_regexp` matcher has a double-expansion bug where user input in request headers gets processed twice through the replacer (the system that substitutes placeholders like {env.DATABASE_URL}), allowing attackers to leak environment variables and file contents by crafting malicious headers. Other matchers like `header_regexp` don't have this problem because they only process the header value once.