Update MATCHED_VAR explanation with airween's technical details

[Copilot]

Incorporated @airween's technical feedback on why MATCHED_VAR and MATCHED_VARS cannot be used as alternative fixes for the CVE-2026-21876 vulnerability.

Changes

• Primary reason added: MATCHED_VAR exhibits the same last-value-only behavior as TX:1, making it equally vulnerable to the multipart bypass attack
• Supporting documentation: Added direct quote from ModSecurity reference manual explaining that MATCHED_VAR "holds data for the last operator match"
• MATCHED_VARS analysis: Explained why the plural variant causes false positives by including all iteration data rather than just the extracted charset values needed for validation

The updated explanation now correctly prioritizes the behavioral similarity over the content format difference.

Before:

A: Because `MATCHED_VAR` contains the **entire** matched string

After:

A: `MATCHED_VAR`'s behavior is almost the same as the `TX:1` captured variable - 
it only holds the **last** inspected target. According to the ModSecurity reference manual:
> This variable holds the value of the most-recently matched variable...
> Note: Be aware that this variable holds data for the last operator match.

So using `MATCHED_VAR` instead of `TX:1` would result in the same vulnerability...

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[cloudflare-workers-and-pages]

Deploying website with    Cloudflare Pages

Latest commit:	0c9a68a
Status:	✅  Deploy successful!
Preview URL:	https://7955fc63.website-1u6.pages.dev
Branch Preview URL:	https://copilot-sub-pr-435.website-1u6.pages.dev

View logs