Fix race condition in FeatureReferences<T>.Fetch

`Fetch` writes `cached = null!` to a ref field on line 103 when it
detects a revision change. This null is visible to concurrent readers
before `UpdateCached` repopulates the field, causing NRE in
`DefaultHttpRequest.set_RouteValues`.

Replace `cached = null!` + `cached ?? UpdateCached(...)` with
`(flush ? null : cached) ?? UpdateCached(...)`. When flush is true,
the ternary evaluates to `null` (a local, not a write to the ref
field), so `UpdateCached` is always called. When flush is false,
the original fast path is preserved. No null is written to the
shared ref field.

Fixes #42040

Author: Ethan Crawford

src/Extensions/Features/src/FeatureReferences.cs

@@ -99,13 +99,11 @@ public void Initalize(IFeatureCollection collection, int revision)
         var revision = Collection?.Revision ?? ContextDisposed();
         if (Revision != revision)
         {
-            // Clear cached value to force call to UpdateCached
-            cached = null!;
             // Collection changed, clear whole feature cache
             flush = true;
         }
 
-        return cached ?? UpdateCached(ref cached!, state, factory, revision, flush);
+        return (flush ? null : cached) ?? UpdateCached(ref cached!, state, factory, revision, flush);
     }
 
     // Update and cache clearing logic, when the fast-path in Fetch isn't applicable