wp_insert_post checks permissions of the current user, not the author

[rmccue]

In wp_insert_post(), current_user_can() is called twice to check permissions (publish_posts for setting the slug and the assign terms capability for taxonomies.

This global state should be removed from wp_insert_post() in favour of user_can() using the post's author.

[rmccue]

(From a quick look, this also applies to wp_insert_attachment() as well.)

[dd32]

Duplicate of #19373.

[nacin]

#19373 (as a new level of API, realistically) is the preferred path forward. The change proposed here actually has security issues with it.