Login-As-Customer and Varnish conflict

Nobody has claimed this yet.

### Preconditions and environment

We found out that Login-As-Customer attempt only works randomly with Varnish and there is a simple reason for that:

- The VCL declares that GET/HEAD requests should filter Set-Cookie-headers:

```
if (beresp.ttl > 0s && (bereq.method == "GET" || bereq.method == "HEAD")) {
unset beresp.http.set-cookie;
}
```

- The Login-As-Customer module JS opens a `GET /loginascustomer/login/index/?secret=***` request and resets the PHP session id
- Resetting the PHP session id will issue a Set-Cookie-Header with the new session id
- The cookie header will be ignored by Varnish
- The login fails since the browser doesn't know the new session id and stills sends the old one

### Steps to reproduce

Enable & configure Varnish and try to login as customer

### Expected result

Login as customer session works.

### Actual result

Login as customer MAY work.

If you are lucky, the session will be recognized - or not if Varnish delivers a cached version.

### Additional information

The issue can be bypassed by configuring the VCL:

```
# Bypass shopping cart, checkout and search requests
if (req.url ~ "/customer" || req.url ~ "/checkout" || req.url ~ "/loginascustomer") {
return (pass);
}

...

# validate if we need to cache it and prevent from setting cookie
if (beresp.ttl > 0s && (bereq.method == "GET" || bereq.method == "HEAD") && !(bereq.url ~ "/loginascustomer")) {
unset beresp.http.set-cookie;
}
```

but should be done correctly by the module itself by sending a `Cache-Control: private` header.

### Release note

_No response_

### Triage and priority

- [ ] Severity: **S0** _- Affects critical data or functionality and leaves users without workaround._
- [ ] Severity: **S1** _- Affects critical data or functionality and forces users to employ a workaround._
- [X] Severity: **S2** _- Affects non-critical data or functionality and forces users to employ a workaround._
- [ ] Severity: **S3** _- Affects non-critical data or functionality and does not force users to employ a workaround._
- [ ] Severity: **S4** _- Affects aesthetics, professional look and feel, “quality” or “usability”._

Start at the Login-As-Customer module's GET /loginascustomer/login/index/ entry point and inspect the response headers when Varnish is enabled. Reproduce the login flow with cached and bypassed requests; done means the response prevents caching and the customer session is consistently recognized.

Written by the indexing model from the issue text.