Fixed #23482 -- Changed SingleObjectMixin to use both pk and slug

Previously, if a URL contained both a pk and slug kwarg, the object
would be looked up by only the pk. The slug was ignored. This could
potentially allow for an insecure direct object reference [0] security
hole in Django applications. Now, when both the pk and slug are
available, lookup the object by both fields. If the lookup fails, 404 as
before.

[0] https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References