feat: rejected-cookie cache exclusions for WooCommerce cart

Add wp_recache_rejected_cookies option (defaults: woocommerce_items_in_cart,
wp_woocommerce_session_*, wp-postpass, comment_author_*, wordpress_*) that
bypasses page cache when any listed cookie is present. Both the WP-level
check (wp_recache_should_exclude) and the standalone drop-in apply the
same exact/prefix matching logic. Editing the option regenerates the
drop-in and purges all cache.

includes/Common/Helpers.php

@@ -58,6 +58,10 @@ function wp_recache_should_exclude() {
         return true;
     }
 
+    if (wp_recache_has_rejected_cookie()) {
+        return true;
+    }
+
     // Dynamic query-string requests are never cached (story 11).
     if (!empty($_SERVER['QUERY_STRING'])) {
         return true;
@@ -83,6 +87,47 @@ function wp_recache_should_exclude() {
     return apply_filters('wp_recache_exclude', false);
 }
 
+/**
+ * Check if a rejected cookie is present in the request.
+ *
+ * @return bool True if any rejected cookie is set.
+ */
+function wp_recache_has_rejected_cookie() {
+    if (empty($_COOKIE)) {
+        return false;
+    }
+
+    $rejected = wp_recache_get_option('rejected_cookies', [
+        'woocommerce_items_in_cart',
+        'wp_woocommerce_session_*',
+        'wp-postpass',
+        'comment_author_*',
+        'wordpress_*',
+    ]);
+
+    foreach ($rejected as $cookie) {
+        $cookie = trim($cookie);
+        if ($cookie === '') {
+            continue;
+        }
+
+        if (substr($cookie, -1) === '*') {
+            $prefix = substr($cookie, 0, -1);
+            foreach ($_COOKIE as $name => $value) {
+                if (strpos($name, $prefix) === 0) {
+                    return true;
+                }
+            }
+        } else {
+            if (isset($_COOKIE[$cookie])) {
+                return true;
+            }
+        }
+    }
+
+    return false;
+}
+
 /**
  * Check if request is for a robot/crawler.
  */