OutputCaching: Avoid locking request with invalid cache key when another request is in-flight

[Youssef1313]

Fixes #67763

Previously, an invalid cache key (surfaced as string.Empty) would let two concurrent requests to serve the same response (var cacheEntry = await _requestDispatcher.ScheduleAsync(context.CacheKey, key => ExecuteResponseAsync());)

We shouldn't call ScheduleAsync with empty CacheKey.

[Copilot]

Pull request overview

This pull request fixes a security-sensitive concurrency issue in OutputCaching where requests with an invalid/empty cache key could still participate in response locking, causing unrelated in-flight responses to be coalesced under the empty dispatcher key.

Changes:

• Skip response locking when CacheKey is null/empty to prevent invalid-key coalescing.
• Add a regression test to ensure concurrent requests with an invalid key execute independently.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/Middleware/OutputCaching/src/OutputCacheMiddleware.cs	Prevents scheduling response-locking work under an invalid/empty cache key.
src/Middleware/OutputCaching/test/OutputCacheMiddlewareTests.cs	Adds a concurrent regression test covering invalid-key locking behavior.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.