Add support for invoker command attributes

[joedolson]

Similar to the support added to popovers, invoker commands are now baseline, and should be allowed in post content.

See #61959.

[joedolson]

E.g., see documentation in ​https://developer.mozilla.org/en-US/docs/Web/API/Invoker_Commands_API, article at ​https://schalkneethling.com/posts/opening-and-closing-dialogs-without-javascript-using-html-invoker-commands/

[westonruter]

Related:

• ​gutenberg#69363: Make the navigation block content available when JavaScript is disabled
• ​gutenberg#69720: Navigation block: use <dialog>

Allow the Invoker Commands API attributes command and commandfor on <button> in $allowedposttags so post content sanitization (wp_kses_post()) no longer strips them. This matches existing support for popovertarget / popovertargetaction from the Popover API work (#61959).

Adds a PHPUnit test that verifies a button with command / commandfor and a popover target survives wp_kses_post().

[afercia]

​https://github.com/WordPress/wordpress-develop/pull/11483 looks good to me.

Question: should we allow the autofocus global attribute?
It's pretty important to handle focus within a <dialog> element.

[westonruter]

Replying to afercia:

Question: should we allow the autofocus global attribute?
It's pretty important to handle focus within a <dialog> element.

My only concern is abuse, where someone could write a post and add autofocus to it as a way to get more eyes on it. So maybe we should open a separate ticket for that, and maybe strip it out automatically if it isn't inside a DIALOG.

[afercia]

Replying to westonruter:

My only concern is abuse, where someone could write a post and add autofocus to it as a way to get more eyes on it. So maybe we should open a separate ticket for that, and maybe strip it out automatically if it isn't inside a DIALOG.

Good point. Agree on creating a new ticket for the autofocus attribute.

[afercia]

I created #65491 for the autofocus attribute. I think this is unblocked now and can be committed.

[afercia]

In 62531:

KSES: Add command and commandfor to the list of allowed attributes for buttons.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/11483

Props pratiknawkar94, joedolson, westonruter, afercia.

Fixes #64576.