Fixed #23482 -- Changed SingleObjectMixin to use both pk and slug

Add new view kwarg SingleObjectMixin.query_pk_and_slug, to optionally
introduce new querying behavior. Default behavior remains as is. When
query_pk_and_slug is True, get_object() will perform its lookup using
both the primary key and the slug.

Helps reduce application security vulnerabilities such as insecure
direct object references.

https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References