Cache-key collision in Microsoft.AspNetCore.OutputCaching

When the default `OutputCacheOptions.UseCaseSensitivePaths = false` is in effect, `OutputCacheKeyProvider.TryAppendBaseKey` builds the base cache key by folding the request path one UTF-16 char at a time through `char.ToUpperInvariant` (`StringBuilderExtensions.AppendUpperInvariant`). Under the default ICU globalization mode this folds `U+017F LATIN SMALL LETTER LONG S (ſ)` to `S`, the same target ASCII `s` folds to, so two paths that ASP.NET Core routing and `StringComparer.OrdinalIgnoreCase` treat as distinct (`/foo/s/…` vs `/foo/ſ/…`) alias to a single OutputCache entry.

Hence the cache-key equivalence is broader than the application/routing path equivalence, allowing the response cached for one path to be served for a distinct path.

Also i.e. `U+212A KELVIN SIGN`.

Start at OutputCacheKeyProvider.TryAppendBaseKey and the StringBuilderExtensions.AppendUpperInvariant call described in the issue. Compare the cache-key folding behavior with ASP.NET Core routing and StringComparer.OrdinalIgnoreCase for the /foo/s/… and /foo/ſ/… paths, including U+212A, then add regression coverage showing distinct paths cannot share an OutputCache entry.

Written by the indexing model from the issue text.