fix(code-field): preserve script and iframe embeds in display output

[faisalahammad]

Description

The Code (Syntax Highlighting) field flow stamped everything through wp_kses_post() starting in Pods 3.1.0, which strips external <script src> and arbitrary <iframe src> embeds. Third-party widgets (SimpleShop form embed, TikTok, Google Reviews, etc.) therefore rendered as visible markup instead of executing on the frontend.

This branches sanitize_output() on field type so only code gets the extended allow-list (wysiwyg, paragraph, heading, text keep the previous behaviour). The extended list adds script[src|type|async|defer|integrity|crossorigin|nonce|charset|data-*] and iframe[src|width|height|frameborder|allow|allowfullscreen|title|loading|referrerpolicy|sandbox|name|id|style|class|data-*]. No on* handlers, no object/embed, no javascript: URLs. A new pods_code_field_sanitize_allowed_html filter lets third parties tighten it.

Sibling: this also fixes #7319 (shortcodes not rendering in code field) because do_shortcode() still runs before sanitization in code.php.

Hardens PodsAdmin::add_debug_information():

• Guard the session_auto_start['data'] lookup so filters cannot trigger Undefined array key warnings.
• Cache session_save_path() once and skip the FS exists/is_writable checks when the path is empty or starts with tcp:// (memcached/redis handlers and open_basedir-restricted hosts).

Related GitHub issue(s)

Fixes #7263
Refs #7319

Testing instructions

1. On a site running Pods 3.3.x, edit any pod with a Code field. Leave the sanitize toggle on (default 1).
2. Paste <script src="https://example.com/widget.js"></script> into the field value and render it via a Pods template ({@field_code}).
3. View the rendered page source: the <script src="..."> tag survives intact instead of disappearing.
4. Paste an embed <iframe src="https://www.youtube.com/embed/abc123" width="560" height="315" allowfullscreen></iframe> and confirm it renders.
5. Open Tools → Site Health → Info → Pods. Verify no PHP warnings on the debug-data request (previously emitted on hosts with open_basedir or tcp:// session handlers).
6. Slic test group: slic run wpunit --group=pods-field and slic run wpunit --group=pods (guards + code embed preserved).

Screenshots / screencast

Not applicable to this change.

Changelog text for these changes

Bug: Code (Syntax Highlighting) fields now render third-party script and iframe embeds correctly; Site Health no longer emits PHP warnings for session_auto_start lookup or tcp:// session handlers.

PR checklist

• I have tested my own code to confirm it works as I intended.
• My code follows the WordPress Coding Standards.
• My code follows the WordPress Inline Documentation Standards.
• My code includes automated tests for PHP and/or JS (if applicable).

[what-the-diff]

PR Summary

• Enhanced Debug Information Method:
  • The add_debug_information method in PodsAdmin.php has been updated to better handle session settings automatically. This cuts down on unnecessary checks and potential warning alerts.
• Boosted Input Cleanliness:
  • PodsField.php now has improved functions for tidying up string and array/object results. This effectively safeguards scripts and frames while allowing more diverse HTML elements for script and frame tags.
• Newly Introduced Tests:
  • New tests added for the add_debug_information function in AdminDebugInformationTest.php to ensure the function could handle errors smoothly without causing any critical errors.
  • New set of unit tests for PodsField_Code in PodsField_CodeTest.php to confirm the consistent embedding and scripting capability

In general, this Pull Request enhances the stability and functionality of the system and builds a more robust foundation for future development.

[faisalahammad]

AI disclosure: this PR was written with Claude Opus 5 assistance, reviewed and tested by me.