Create a sniff to make sure filter_input is not used with only the default settings

[moorscode]

As the default is RAW INPUT, this does not add anything.

[moorscode]

This can be added to the sniff introduced in #74

[jrfnl]

👋🏻 We also need to make sure to forbid the string filter which has been deprecated in PHP 8.1.

[diedexx]

@increddibelly, @jrfnl had a discussion about the filter functions and came up with a list of filter that we want to forbid:

FILTER_SANITIZE_MAGIC_QUOTES
FILTER_SANITIZE_STRING (unless option flags are given)
FILTER_SANITIZE_STRIPPED (unless option flags are given)
FILTER_DEFAULT
FILTER_UNSAFE_RAW

[jrfnl]

And let's extend the filter requirements to ALL functions in the Filter extension: https://www.php.net/manual/en/book.filter.php

[jrfnl]

Also loosely related #34

[jrfnl]

Related upstream issues:

• filter_input() doesn't mean variable is sanitized WordPress/WordPress-Coding-Standards#512
• FILTER_SANITIZE_STRING is not a valid sanitization WordPress/WordPress-Coding-Standards#2018

Any sniff we would create here would be a candidate to be pulled upstream at a later point in time.

[jrfnl]

Been doing some digging into the filter extension and discovering more and more WTFs.

The sniff I'm currently writing will comprehensively check for all of them. You may not like what you see when we run the sniff over the various code bases....