Fixed #23482 -- Changed SingleObjectMixin to use both pk and slug

Add new view kwarg SingleObjectMixin.query_pk_and_slug, to optionally
introduce new querying behavior. Default behavior remains as is. When
query_pk_and_slug is True, query using both the pk and slug as
provided in the URL.

Helps reduce application security vulnerabilities such as insecure
direct object references.

https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References