fix: add object-level authorization to corrections REST endpoint

[adekbadek]

Summary

• Fixes IDOR/broken-access-control in the corrections REST save endpoint
• The endpoint only checked edit_posts (generic capability), allowing any author/editor to manage corrections on posts they don't own
• Adds current_user_can( 'edit_post', $post_id ) check for the specific target post
• Adds IDOR regression test

Test plan

• Log in as an author, attempt to save corrections for another user's post -- should get 403
• Log in as an editor, save corrections for any post -- should succeed (editors can edit all posts)
• Run n test-php --group corrections -- all 21 tests pass

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR tightens authorization for the Corrections REST “save” endpoint to prevent IDOR/broken-access-control by ensuring the current user can edit the specific target post.

Changes:

• Add an object-level capability check (current_user_can( 'edit_post', $post_id )) in Corrections::rest_save_corrections.
• Add a unit test ensuring an author cannot save corrections for another user’s post.
• Update test fixtures to run REST-save tests as an editor by default.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
includes/corrections/class-corrections.php	Adds per-post authorization enforcement inside the REST save handler.
tests/unit-tests/corrections.php	Adds an IDOR regression test and updates setup to use an editor user.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Hey @adekbadek, good job getting this PR merged! 🎉

Now, the needs-changelog label has been added to it.

Please check if this PR needs to be included in the "Upcoming Changes" and "Release Notes" doc. If it doesn't, simply remove the label.

If it does, please add an entry to our shared document, with screenshots and testing instructions if applicable, then remove the label.

Thank you! ❤️