Global Styles: Reject non-string custom CSS in the REST controller

[ramonopoly]

Ticket to track the backport of ​https://github.com/WordPress/gutenberg/pull/80338

In the global styles REST controller, we need to guard validate_custom_css() against non-string values, returning a 400 error instead of a fatal.

styles.css has no type constraint in the request schema, so a consumer can PUT an array (or any other type). That value can reach strlen() and throw an uncaught TypeError on PHP 8+.

Seen in the wild from third-party REST consumers; neither the editor UI nor Core sends non-strings.

styles.css has no type constraint in the global styles request schema, so a REST consumer can PUT an array (or any non-string value). That value reaches strlen() in validate_custom_css() and throws an uncaught TypeError on PHP 8+.

Guard validate_custom_css() against non-string input, returning a rest_custom_css_invalid_type WP_Error with a 400 status instead of a fatal.

Adds a controller test that PUTs styles.css as an array and asserts the 400 response, plus unit tests covering array, integer, boolean, null, and object values.

Backports ​https://github.com/WordPress/gutenberg/pull/80338

Trac ticket: #65640.

[ramonopoly]

In 62762:

REST API: Reject non-string custom CSS in the global styles controller

This commit guards validate_custom_css() against non-string input, returning a rest_custom_css_invalid_type WP_Error with a 400 status instead of a fatal.

Before, styles.css had no type constraint in the global styles request schema, so a REST consumer could PUT an array (or any non-string value). That value reached strlen() in validate_custom_css() and threw an uncaught TypeError on PHP 8+.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/12549(​https://github.com/WordPress/wordpress-develop/pull/12549)

Props andrewserong, ramonopoly.

Fixes #65640.