If we get an illegal og bogus Vary: header from the backend,
turn the transaction into a "pass" and complain in VSL.

Previously we faulted the fetch, but that was overly draconian.