SanitizationHelperTrait: stop requiring unslash for functions that strip slashes

[rodrigoprimo]

Description

As discussed in #2516, the WordPress.Security.ValidatedSanitizedInput sniff incorrectly reported a MissingUnslash error when one of the following functions was used directly on superglobal data without first calling wp_unslash() (or a similar unslashing function):

• esc_url_raw() / sanitize_url(): delegates to esc_url(), whose regex [^a-z0-9-~+_.?#=!&;,/:%@$|*'()\[\]\x80-\xff] strips backslashes.
• sanitize_email(): the regex [^a-zA-Z0-9!#$%&'*+/=?^_`{|}~.-] strips backslashes.
• sanitize_file_name(): \ is explicitly included in the $special_chars array passed to str_replace().
• sanitize_hex_color(): returns the input only if it matches ^#([A-Fa-f0-9]{3}){1,2}$, otherwise returns nothing.
• sanitize_hex_color_no_hash(): delegates to sanitize_hex_color().
• sanitize_html_class(): regex [^A-Za-z0-9_-] strips backslashes.
• sanitize_mime_type(): regex [^-+*.a-zA-Z0-9\/] strips backslashes.
• sanitize_sql_orderby(): returns the input only if it matches one of two regexes (neither of which allows backslashes), false otherwise.
• sanitize_title_with_dashes(): final regex [^%a-z0-9 _-] strips backslashes.
• wp_sanitize_redirect(): regex [^a-z0-9-~+_.?#=&;,/:%!*\[\]()@] strips backslashes.
• sanitize_title(): the function body itself doesn't strip backslashes, but it calls apply_filters( 'sanitize_title', ... ) and sanitize_title_with_dashes() is hooked to that filter by default.
• sanitize_title_for_query(): wraps sanitize_title( $title, '', 'query' ), so same reasoning as sanitize_title().

All of these implicitly strip backslashes from their output, so requiring a separate unslashing call before them is a false positive as far as I can see. This moves them from $sanitizingFunctions to $unslashingSanitizingFunctions in SanitizationHelperTrait.

This change only affects the WordPress.Security.ValidatedSanitizedInput sniff.

To verify that the functions above indeed strip slashes, I used wp shell to call them with strings containing slashes and checked that the slashes were removed from the returned value.

Fixes #2516.

Suggested changelog entry

WordPress.Security.ValidatedSanitizedInput: false positive MissingUnslash for esc_url_raw(), sanitize_email(), sanitize_file_name(), sanitize_hex_color(), sanitize_hex_color_no_hash(), sanitize_html_class(), sanitize_mime_type(), sanitize_sql_orderby(), sanitize_title(), sanitize_title_for_query(), sanitize_title_with_dashes(), sanitize_url() and wp_sanitize_redirect(), which implicitly strip slashes and therefore do not require unslashing.

[rodrigoprimo]

Rebased and force-pushed without changes to make the Codecov GH action pass.