fix(cache): log a key digest, not the cache key, on backend failure

[allen0099]

Summary

@cache's fail-open warnings ("Cache backend read failed" / "Cache backend write failed") logged the full cache key at WARNING. The key holds the raw query string (?token=..., ?code=..., e-mails), vary header values (#268) and any build_cache_key components (user IDs etc.).

• New fastapi_cachex.types.log_ref(value): first 12 hex digits of SHA-256 (UTF-8, surrogatepass), which is exactly what _state_ref in state/manager.py did. _state_ref now delegates to it, so OAuth state refs and cache key refs use the same format.
• cache.py: both warnings go through _log_backend_failure(), which logs method=... path=%r key_ref=... error=%r at WARNING and key_ref=... key=<full key> at DEBUG. The shared key_ref lets you match a warning to its key.
• manager.py: CacheManager.get()'s "Failed to decode cached value" warning had the same problem, and developer keys often embed user IDs or e-mails. It now logs key_ref at WARNING and the key at DEBUG.
• Docs: added a paragraph to "When the backend fails" in docs/HTTP_CACHING.md and its zh-TW mirror.
• Fragment: changelog.d/299.security.md.

Path and log forging

The path is client input and is percent-decoded. It is logged with %r, so control characters come out escaped. Starlette's request.url already strips CR/LF/tab (urllib's urlsplit), so newline forging was not possible through this field. ANSI escapes (\x1b) and U+2028 did get through, and %r now escapes them. A test drives the ASGI app directly with such a path, because test clients normalise it. No other WARNING+ site logs the path; the existing DEBUG sites use path=%s and were left alone.

Audit of other log sites (INFO and above)

• cache.py: the two sites above were the only WARNING+ calls. invalidate(), clear_path() and every other key log are DEBUG only.
• routes.py, lock.py, proxy.py, backends (memory/redis/memcached): DEBUG only, nothing to change.
• manager.py: fixed (above).
• state/manager.py: already uses a digest (StateManager logs raw OAuth state values at WARNING #107).
• session/manager.py: two WARNINGs about missing IP/UA binding, with no keys or values. Nothing to change.

DEBUG logging still writes full keys, query strings, session IDs and client IPs throughout. That is intended for local troubleshooting, as the issue proposes.

Tests

• tests/test_cache_backend_failure.py: read and write failures (fail_open=True) with ?token=...&email=... and a vary=["X-Tenant"] value. At WARNING the token, e-mail, tenant value and ||| are absent, and method, path='/callback', error and the digest are present. At DEBUG the full key is present, and its SHA-256 matches key_ref. A second test covers the control-character path.
• tests/test_cache_manager.py: the decode-failure warning carries key_ref, not the key, and DEBUG has the key.

ruff check, ruff format --check, mypy --strict: clean. pytest: 997 passed, 194 skipped (no live Redis/Memcached). Coverage is 93.77%; cache.py, manager.py and types.py are at 100%.

Closes #299