I use make run-caddy and access http://localhost:9080 without cookie set.

If I'm reading the code correctly, right now all the esi tags are parsed and processed sequentially. This means that if there are 5 esi:includes each taking 50 ms, it'd add up to 250 ms instead of potentially only taking 50 ms if they were all requested at once.

A remedy to this would be to first parse the input, then process all found tags all at once, and only then insert the results in tags' place in the body to be returned.

Specification says:

6. Protocol Considerations
   When an ESI template is processed, a separate request will need to be made for each include encountered. Implementations may use the original request's headers (e.g., Cookie, User-Agent, etc.) when doing so. Additionally, response headers from fragments (e.g., Set-Cookie, Server, Cache-Control, Last-Modified) may be ignored, and should not influence the assembled page.

(emphasis mine)

When creating the child request, some of the headers need to be included for the child response to be constructed properly, for example Cookie / Authorization headers are required to know the identity of the user for which we're constructing the child response.

Security considerations

Some of these headers must NOT be forwarded in cross-origin scenarios. For example, Cookie and Authorization musn't be passed unless the child request's host, port and scheme all match. IMO the best approach is to have an allow list of headers in general and a separate list of same-origin headers.

I notice you're using full URLs in all examples. Symfony ESI will by default generate hostless URLs when generating the ESI include block:
https://symfony.com/doc/current/http_cache/esi.html

Are these supported?

Example:

<esi:include src="/_fragment?signature=..."/>