PHPCS - WordPress.Security.NonceVerification

[tijmenbruggeman]

Solved every violation of WordPress.Security.NonceVerification

Changes

• Remove the phpcs exclusion rule
• A tricky issue with the pagebuilder check. When working in a pagebuilder we didn't want to transform images to picture elements. Therefor we check for known pagebuilder parameters and skip transformation if we found one. When accessing the parameter we did not have a nonce check nor can have one because the parameters are set outside our domain. Fortunately filter_has_var is enough to verify the presence of a parameter so we can replace it. filter_has_var only reads from the initial input parameter so our unit tests cannot set $_GET. This forced me to override the variable check in the test.
• The ajax call for notifications did not contain a nonce. This has been added in admin.js. I also modernized the js and replaced jquery calls with plain js.
• removed the base check_ajax_referer and replaced it with core check_ajax_referer. This allows phpcs to be valid and we can steer its behaviour a bit better.