Fixed #23482 -- Changed SingleObjectMixin to use both pk and slug 

Previously, if a URL contained both a pk and slug kwarg, the object
would be looked up by only the pk. The slug was ignored. This could
potentially allow for an insecure direct object reference [0] security
hole in a Django applications. Now, when both the pk and slug are
available, look up the object by both fields. If the look up fails, 404
as before.

[0] https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References