Introduce infrastructure for testing primitive capabilities granted via `user_has_cap`

[flixos90]

There are three ways of granting capabilities to a user:

• Via the database, with capabilities being granted through a role. Those capabilities are referred to as "primitive capabilities".
• Via the map_meta_cap filter, with capabilities being resolved to one or more primitive capabilities. Those capabilities are referred to as "meta capabilities".
• Via the user_has_cap filter, with capabilities being granted as if they were in the database too. This has existed for a very long time, but has not been used in core until recently.

So what is this about?

New capabilities introduced to core should not be added to the database. However, many of the new capabilities are not meta capabilities, and it would be wrong to use map_meta_cap for them. Those capabilities should be dynamically granted, but essentially behave just like primitive capabilities.

There are numerous of those capabilities in core that historically use map_meta_cap() (for example customize, manage_privacy_options, ...), and we probably cannot change that. But for the future, we should ensure we stick to this separation and only use map_meta_cap() for actual meta capabilities, i.e. capabilities that receive additional arguments (like a post ID, a plugin slug, ...) and are then resolved.

Originally introduced as part of #41332 (but not being suitable for discussion in there), this ticket aims at providing a comprehensive testing infrastructure for those capabilities. While currently the only capability granted like that is install_languages, this infrastructure will encourage granting dynamic primitive capabilities the proper way.

cc @johnbillion

[flixos90]

44468.diff​ adds the infrastructure for testing the so-called "dynamic primitive capabilities":

• All those capabilities need to be added to the _getSingleSiteDynamicPrimitiveCaps() and _getMultiSiteDynamicPrimitiveCaps() methods, just how it is for the other two types of capabilities.
• It is checked that each of the capabilities are correctly granted via user_has_cap.
• It is also checked that each of the capabilities are actually granted via user_has_cap and not through another means (like the database).

[flixos90]

@johnbillion What do you think of this? Particularly, is "dynamic primitive" a good name here? Does this need more work or is it good to start with in your opinion?

[pento]

This patch needs reviewing.

[desrosj]

Still needs reviewing and testing.

[davidbaumwald]

This ticket still needs a review. With Beta 1 of version 5.3 only a few days away, this is being moved to Future Release. If this ticket can be resolved in time for 5.3, feel free to re-milestone.