1.3.0-beta1: API freeze for the 1.3.x vary-cookies track

Cut after alpha3 came back from a clean re-test on portal-dev with
both alpha2 bugs verified fixed:

- ESI fragments render and invalidate via cache tags (alpha2 bug
  fixed by the Markup::create wrap forward-ported from 1.2.0-alpha3).
- vary_cookies emits X-LiteSpeed-Vary: cookie=NAME on every cacheable
  response (alpha2 bug fixed by dropping the cache-context-required
  emission logic).
- No regressions on inherited 1.1 admin-route + cache-poisoning
  checks.

Same code as 1.3.0-alpha3 plus a README addition documenting the
matching LSWS server-side CacheVary directive. The reporter caught
this as a doc-level gap during the re-test - header was emitting
correctly but LSWS didn't honour it without the server-side hint.

What 1.3 ships: named vary-cookie support on top of 1.2.x's ESI
work and 1.1.x's private cache. Operators configure cookie names
in the settings form; the response subscriber emits the vary
header for every configured cookie on every cacheable response.

Cumulative: 1.3.0-beta1 contains all 1.0.x stable code + 1.1.x
private cache + 1.2.x ESI + 1.3.x vary cookies. Operators wanting
to validate the full 1.x line on one install can soak this build.

Stability commitment: vary_cookies config schema, the
X-LiteSpeed-Vary emission contract, and the matching CacheVary
directive expectation are stable from this release. Path to 1.3.0
stable is bug-fix only.

Known issue carried forward, not blocking beta1: post-PURGE re-cache
flake on responses without ESI markup, observed by the adopter
during alpha3 re-test. Couldn't be isolated; flagged for further
investigation.