fix: Task 1 review round 2 - custom CSS builder-only, no settings on gvid/font references

S26: every css.* path is gated like S7 for users without unfiltered_html.
S27: Divi ignores settings on global variable and theme font references,
so any settings there are rejected.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/Unit/Integrations/Divi/Compose/VariableRefTest.php

@@ -134,6 +134,8 @@ final class VariableRefTest extends TestCase
                 '$variable({"type":"color","value":{"name":"gcid-a1b2;}</style><script>alert(1)</script>","settings":{}}})$',
                 'Name',
             ],
+            'settings on a global variable' => [self::content('gvid-s1', '{"before":"<b>x</b>"}'), 'before'],
+            'settings on a theme font' => [self::content('--et_global_heading_font', '{"after":""}'), 'after'],
             'unknown settings key' => [self::content('post_title', '{"before":"","foo":"1"}'), 'foo'],
             'setting the option lacks' => [self::content('post_featured_image', '{"before":"x"}'), 'before'],
             'enable_html' => [self::content('custom_meta_telefon', '{"before":"","after":"","enable_html":"on"}'), 'enable_html'],