Fix sanitizeHTML performance overhead and HTML-in-translation strings

[datengraben]

$(cat <<'EOF'

Summary

Addresses the three issues raised by @sbomsdorf in wielebenwir#2043.

1. Performance — commonsbooking_sanitizeHTML() rebuilt on every call

Before: every call rebuilt a 29-key $allowed_atts array from scratch and overwrote those entries on the global $allowedposttags. On a single admin settings page load this runs ~200 times — pure redundant CPU work.

After: a static $allowed_tags = null variable builds the merged allowed-tags list once per request via array_merge() and passes it directly to wp_kses(). The global $allowedposttags is no longer mutated.

2. Late escape — plain-text title/name/default fields in settings arrays

111 entries across includes/OptionsArray.php and src/CB/CB1UserFields.php wrapped plain-text translation strings in commonsbooking_sanitizeHTML() at array-definition time, e.g.:

// Before
'title' => commonsbooking_sanitizeHTML( __( 'Booking codes', 'commonsbooking' ) ),

// After
'title' => __( 'Booking codes', 'commonsbooking' ),

Plain text contains no HTML to sanitize. The wrapper was removed; CMB2 applies its own escaping at render time (late-escape pattern). The remaining commonsbooking_sanitizeHTML() calls in those files are all legitimately applied to HTML-containing desc and multi-line email-body default values.

3. HTML out of translation strings

<li><a href="%s">...</a></li> patterns inside __() replaced with explicit PHP string construction using esc_url() + esc_html__(). Translators now only see the plain link label, not fragile markup they could accidentally break.

Files changed:

• src/Wordpress/Widget/UserWidget.php — 5 list-item link strings
• src/CB/CB1UserFields.php — terms-and-services link; also fixes pre-existing malformed attribute target=_blank" → target="_blank"

Test plan

• Load the CommonsBooking admin settings page and confirm all tab titles, field labels, and descriptions render identically to before
• Log in as a user and verify the UserWidget shows "Welcome", "My Bookings", "My Profile", "Log out" links correctly
• Log out and verify the UserWidget shows "You are not logged in.", "Login", "Register" links correctly
• On a site with a terms-and-services URL configured, confirm the registration form shows the terms link with a working target="_blank" attribute
• Run composer test — PHPUnit suite passes

https://claude.ai/code/session_01P1DDnvRKzHdx7jepeTf3ju
EOF
)