fix(security): Divi-markup refusal sees content as storage will (ruling S52)

Control characters removed by kses (wp_kses_no_null: C0, \\0 sequences)
or ControlChars (DEL) could hide a divi/* delimiter or an et_pb shortcode
from the raw-input check. The shared DiviMarkup helper checks the raw
and the normalized form and now guards every raw-content path:
content-create/-update content and media-update description (attachment
post_content). MediaImporter logs import failures with scheme, host,
port and path only; uninstall.php lists the removed user meta.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Integrations/WordPress/Content/PostWriterTest.php

@@ -89,6 +89,12 @@ final class PostWriterTest extends TestCase
             "<p>x</p><!--\twp:divi/text {\"a\":1} /-->",
             "<!--\n\n/wp:divi/row -->",
             '[et_pb_section][/et_pb_section]',
+            // Ruling S52: control characters are removed before storage, so they cannot hide the markup.
+            "<!--\0 wp:divi/text {\"a\":1} /-->",
+            "<!-- wp:di\0vi/text /-->",
+            "<!-- wp:divi\x01/text /-->",
+            "[et_\0pb_section][/et_pb_section]",
+            '<!-- wp:di\\0vi/text /-->',
         ];
         foreach ($refused as $content) {
             foreach ([true, false] as $isCreate) {