A-z regex typo in Signer separator validation (django/core/signing.py)

[Harsh Parmar]

_SEP_UNSAFE in django/core/signing.py currently is:

_SEP_UNSAFE = _lazy_re_compile(r"^[A-z0-9-_=]*$")

A-z is the classic ASCII-range regex typo: it spans A (0x41) through
z (0x7A) inclusive, which — besides A-Z and a-z — also sweeps in
six punctuation characters that sit between Z and a in ASCII:
[ \ ] ^ _ (_` was already intended; the other five are the bug).

>>> import re
>>> p = re.compile(r'^[A-z0-9-_=]*$')
>>> p.match('^')   # True -- should be False, '^' is not in A-Za-z0-9-_=
>>> p.match('{')   # False -- correctly rejected

This regex rejects "unsafe" sep values passed to Signer/
TimestampSigner. The typo only makes the *rejected* set larger than
intended (fails safe, not a security issue) — it just causes a few
legitimate-but-unlikely separator choices like sep="^{" to be wrongly
rejected with a ValueError.}

Suggested fix:

_SEP_UNSAFE = _lazy_re_compile(r"^[A-Za-z0-9-_=]*$")

I have a patch + regression test ready as a PR.