condfetch: Check stale_oc bans before and after revalidation

Unlike a purge, ban processing is deferred until the next lookup, or ban
lurker batch. Considering the windows between a cache lookup and either
the beginning (or restart) of a fetch task, or the retrieval of a 304
response, banning an object may not result in preventing a condfetch off
an invalid stale object.

This is especially true for object-based bans, that are not evaluated by
the ban lurker until at least ban_lurker_age seconds.

bin/varnishd/cache/cache_fetch.c

@@ -269,6 +269,9 @@ vbf_stp_mkbereq(struct worker *wrk, struct busyobj *bo)
 	}
 	http_ForceField(bo->bereq0, HTTP_HDR_PROTO, "HTTP/1.1");
 
+	if (bo->stale_oc != NULL)
+		HSH_CheckBans(wrk, bo->stale_oc);
+
 	if (bo->stale_oc != NULL && !(bo->stale_oc->flags & OC_F_DYING) &&
 	    ObjCheckFlag(bo->wrk, bo->stale_oc, OF_IMSCAND) &&
 	    (bo->stale_oc->boc != NULL || ObjGetLen(wrk, bo->stale_oc) != 0)) {
@@ -835,6 +838,8 @@ vbf_stp_condfetch(struct worker *wrk, struct busyobj *bo)
 	stale_oc = bo->stale_oc;
 	CHECK_OBJ_NOTNULL(stale_oc, OBJCORE_MAGIC);
 
+	HSH_CheckBans(wrk, stale_oc);
+
 	if (stale_oc->flags & OC_F_DYING) {
 		(void)VFP_Error(bo->vfc, "Template object invalidated");
 		vbf_cleanup(bo);