[PCP] Phase 4: MissingUnslash for $_POST

[faisalahammad]

Fix: WordPress.Security.ValidatedSanitizedInput.MissingUnslash (lines 394, 402, 535, 649)

Changes

• Line 394: Wrap $_POST['classic-editor-user-settings'] with wp_unslash() before wp_verify_nonce()
• Line 402: Wrap $_POST['classic-editor-replace'] with wp_unslash() before self::validate_option_editor()
• Line 535: Wrap $_POST['classic-editor-network-settings'] with wp_unslash() before wp_verify_nonce()
• Line 649: Wrap $_POST['_wp_http_referer'] with wp_unslash() before strpos()

All existing phpcs:ignore annotations preserved; only wp_unslash() wrapping added.

Rule code

WordPress.Security.ValidatedSanitizedInput.MissingUnslash

Verification

• PHPCS with WordPress standard: zero violations for MissingUnslash