fix: resolve Plugin Check input-handling warnings

[faisalahammad]

Summary

Resolves the input-handling warnings from a WordPress.org Plugin Check report that fall inside our codebase. The remaining warnings in the report are in phpScoper-scoped vendored code under dependencies/ or dev-only tests/, so they are left untouched.

Fixes #N/A

Changes

src/Simple_Document_Library.php

Before:

$draw   = isset( $_POST['draw'] ) ? intval( $_POST['draw'] ) : 1;
$order  = isset( $_POST['order'] ) && is_array( $_POST['order'] ) ? $_POST['order'] : [];

After:

$draw   = isset( $_POST['draw'] ) ? intval( wp_unslash( $_POST['draw'] ) ) : 1;
$order  = isset( $_POST['order'] ) && is_array( $_POST['order'] ) ? wp_unslash( $_POST['order'] ) : [];

Why: AJAX table paging/sort/search reads $_POST without wp_unslash(), inconsistent with the file's own pattern. The order array is now range-checked against the columns list and sort_order only accepts asc/desc. Nonce is still verified at the dll_load_posts route, so no change there.

src/Admin/Settings.php

Before:

$option_page = isset( $_REQUEST['option_page'] ) ? sanitize_key( $_REQUEST['option_page'] ) : '';

After:

$option_page = isset( $_REQUEST['option_page'] )
    ? sanitize_key( wp_unslash( $_REQUEST['option_page'] ) )
    : '';

Why: $_REQUEST['option_page'] was read raw with no wp_unslash(). WP core already verifies the options nonce in options.php before this callback runs, so the nonce warning is a false positive; the raw read was the real gap.

src/Admin/Metabox/Document_Link.php

Before:

if ( ! isset( $_POST['dll_document_link_nonce'] ) || ! wp_verify_nonce( $_POST['dll_document_link_nonce'], 'dll_save_document_link' ) ) {

After:

if ( ! isset( $_POST['dll_document_link_nonce'] ) || ! wp_verify_nonce( wp_unslash( $_POST['dll_document_link_nonce'] ), 'dll_save_document_link' ) ) {

Why: The nonce check, capability check, and autosave guard were already correct. Only the input read needed the WP-standard wp_unslash().

Testing

Test 1: AJAX table paging, sort, and search

1. Add [doc_library lazy_load="true"] to a page with several documents.
2. Load the page and use pagination, column sort, and the search box.
   Result: works with no PHP warnings in the log.

Test 2: Settings save

1. WP admin > Documents > Settings, change a value on any tab, save.
   Result: setting persists, no PHP warning on save.

Test 3: Document metabox save

1. Edit a dlp_document, change the document link type, save.
   Result: metabox value persists, no PHP warning on save.

Screenshots

Not applicable (no visible UI changes).