Ensure wp_roles() returns an instance of WP_Roles

[marian1]

Currently, wp_roles() only checks whether the global variable $wp_roles is set before returning it. As global variables can be overridden, it should verify that $wp_roles is indeed a WP_Roles object to ensure that wp_roles() consistently returns a WP_Roles instance.

Refer to wp_scripts() and wp_styles() for the correct approach.

See #62562 for another example where the type of a global variable is not properly checked.

The original implementation of wp_roles() only checked whether the global variable $wp_roles was set (isset) before returning it. This could lead to issues if $wp_roles was set to a non-WP_Roles value, resulting in potential errors or unexpected behaviour.

The fix introduces an additional check to ensure that $wp_roles is an instance of WP_Roles. If it is not, a new WP_Roles object is instantiated, ensuring that wp_roles() always returns a valid WP_Roles instance.

Trac ticket: https://core.trac.wordpress.org/ticket/62959

[westonruter]

In 63490:

Role/Capability: Ensure wp_roles() returns WP_Roles.

Previously wp_roles() only checked whether the $wp_roles global was set before returning it, so any code that overwrote that global with another value caused the function to hand back something which is not a WP_Roles object. Checking instanceof instead guarantees the return type, matching the approach already used by wp_scripts() and wp_styles().

Developed in ​https://github.com/WordPress/wordpress-develop/pull/8315.
Follow-up to r32541.

Props marian1.
See #62562.
Fixes #62959.