vars: Add matcher placeholder handling tests

[steadytao]

Adds focused regression coverage for #7629.

Summary

This adds table-driven tests for matcher-side placeholder handling in vars and vars_regexp.

The main goal is to cover the case where already-resolved values contain placeholder syntax such as {env.SECRET} and must not be re-expanded by the matcher. It also adds a compatibility case to make sure matcher-side values still expand placeholders as before.

Behaviour

Added coverage to verify that:

• VarsMatcher does not re-expand resolved values from literal vars
• VarsMatcher does not re-expand resolved values from placeholder-key lookups
• matcher values in VarsMatcher still expand placeholders
• MatchVarsRE does not re-expand resolved values from literal vars
• MatchVarsRE does not re-expand resolved values from placeholder-key lookups

These tests exercise the matcher boundary directly by injecting already-resolved values into VarsCtxKey which matches the behavior changed in #7629.

Assistance Disclosure

No AI was used.

[mholt]

Thank you!

Happy to merge this as-is; one other thought I had is, do you think it's worth adding a test where a placeholder that accesses the query string is used? e.g. {http.request.uri.query.foo} -- obviously it shouldn't matter, but it should go to document that we've covered that case as well. (I actually got a duplicate report that used the query string, instead of the header, I presume because they did not realize the patch was universal.)

[steadytao]

Do you think it's worth adding a test where a placeholder that accesses the query string is used? e.g. {http.request.uri.query.foo}

Would be worth. Will do so now.

[mholt]

Beautiful. Thanks!