1.3.0-alpha3: ESI Markup wrap + vary-cookies always-emit-when-configured

Two bug fixes from the 1.3.0-alpha2 adopter field test on portal-dev.

Fix 1 (forward-port from 1.2.0-alpha3): ESI render element wraps its
treats the emitted <esi:include> tag as already-trusted. Without the
wrap, Xss::filterAdmin stripped the tag entirely and ESI fragments
produced no output. Same wrap applied to the missing-callback fallback
marker.

Fix 2: vary-cookie emission no longer requires the response to declare
a matching cookies:NAME cache context. Alpha2's logic intersected the
configured cookie list with the response's cache contexts, which
silently dropped the header on any response whose render code didn't
happen to declare the context — meaning the feature was inert for
most installs. Alpha3 emits X-LiteSpeed-Vary: cookie=A,B,C for every
configured cookie on every cacheable response. LSWS handles cookies
that are absent from a given request as "no variance" cleanly. The
operator's config IS the directive.

Existing vary-cookie unit tests updated to match the new always-emit
behaviour. Empty-config default still emits no header, so installs
that don't configure vary cookies see no behaviour change.