Escape URLs interpolated into markup

[obenland]

Escapes URLs on their way into markup, clearing 541 WordPress.Security.EscapeOutput violations (3,030 → 2,489).

Where a wrap put a line into the diff, the other violations the changed-lines linter reports for that line are fixed alongside it, which is what most of the non-esc_url() changes are.

Commit by commit:

1. Wraps URL-returning function calls in esc_url(), and normalises call spacing and statement semicolons on the lines involved.
2. Swaps get_stylesheet_directory_uri() concatenation for get_theme_file_uri() in the three themes it appeared in. Two of them are children of bb-base, and get_theme_file_uri() falls back to the parent when the child has no file of that name, so every asset they reference was checked to exist in the child directory first. The output is unchanged. Query strings stay outside the call so the file lookup still matches.
3. Registers wporg_login_wordpress_url() as pre-escaped. It returns esc_url( $url ) already, so a ruleset entry suits it better than a second wrap at each of its nine call sites.
4. Covers two files whose URLs sit on lines carrying unrelated violations. Browse Happy loses its IE 9 and older conditional markup, the PNG fix script that only ran on IE 6, and that script's now unused asset. The bb-base nav sets its current class with a ternary rather than an inline conditional block.
5. Handles the URLs that reach output through a variable. Each was traced back to its assignment first. In the showcase home template the value was already escaped when assigned, which doubled as the validity check, so validation moves to esc_url_raw() and both the link and the displayed text are escaped where they are output.
6. get_target_url() appended REQUEST_URI to the redirect target without sanitising it, and printed the result into an HTML comment when redirects are off.
7. Escapes variables holding prebuilt anchors with wp_kses_post() rather than esc_url(). The notable users list turned out to hold plain URLs despite its name, and takes esc_url().
8. The rest: forum permalinks inside a translated link, a host component that wants esc_html(), and a core function that assembles its own escaped markup, which is left unwrapped. The bounced emails script writes a terminal report, so the sniff is turned off for that file.
9. Escapes plugin tags and handbook titles where they are assembled rather than at the outlet, so markup no longer survives in them.
10. The link functions returning a plain URL that the first sweep did not match on name.
11. Review follow-ups: the .ie6 rules Browse Happy no longer has a class for, esc_url_raw() on the Openverse debug comment so it matches the URL the redirect uses, the misnamed guard variable in the review notice, a string cast where get_edit_post_link() can return null, and get_sample_permalink_html() moved from the ruleset to a scoped phpcs:ignore at its one call site.

Left for follow-ups:

• Functions like gp_link_get() and the bbPress author links return markup, so they want wp_kses_post() or a ruleset entry once each has been checked.
• Exception messages are untouched. There are 45 of them and none currently escape, so that is one decision rather than a few.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.