fix(audit L1): Schleifen-Rechteprüfung auf dem bereinigten Wert (sanitize_text_field-Umgehung) und mit sanitize_key-Lesart von enable/queryType

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/Support/DiviWriterFixture.php

@@ -50,12 +50,14 @@ final class DiviWriterFixture
     public static function composition(
         DesignSystemReader $design,
         bool $unfiltered = false,
-        ?DynamicContentMap $registry = null
+        ?DynamicContentMap $registry = null,
+        bool $listUsers = true,
+        bool $readPrivate = true
     ): DiviComposition {
         return new DiviComposition(
             self::modules(),
             $design,
-            ComposeFixture::sanitizer($unfiltered),
+            ComposeFixture::sanitizer($unfiltered, $listUsers, $readPrivate),
             ComposeFixture::media(),
             $registry ?? new DynamicContentMap()
         );
@@ -106,7 +108,9 @@ final class DiviWriterFixture
         ?GlobalEdits $globals = null,
         ?ThemeBuilderEdits $themeBuilder = null,
         ?SimilarSections $similar = null,
-        ?DynamicContentMap $registry = null
+        ?DynamicContentMap $registry = null,
+        bool $listUsers = true,
+        bool $readPrivate = true
     ): DiviWriter {
         $design = self::designReader();
 
@@ -115,7 +119,7 @@ final class DiviWriterFixture
             self::saver($saved, $failures),
             self::log(),
             $design,
-            self::composition($design, $unfiltered, $registry),
+            self::composition($design, $unfiltered, $registry, $listUsers, $readPrivate),
             $globals,
             $themeBuilder,
             $similar