Validate metadata term in calendar AJAX update handler

[GaryJones]

Summary

EF_Calendar::handle_ajax_update_metadata accepted a metadata_term
value from the request and used it in two ways without checking what
it referred to. For editorial metadata updates it was concatenated
into a post meta key of the form _ef_editorial_meta_{type}_{term};
for taxonomy updates it was passed straight to wp_set_post_terms
as the taxonomy argument. A user with edit_post capability could
therefore write arbitrary post meta keys on a post, or assign terms
from any registered taxonomy — including taxonomies not intended to
be edited from the calendar.

This PR constrains metadata_term before it is used. For the
editorial metadata branch the term must match the slug of an
existing editorial metadata term (via get_editorial_metadata_term_by).
For the taxonomy branch it must be a taxonomy registered on the post's
post type (via get_object_taxonomies). Both inputs are also sanitised
up front so the phpcs:disable block narrows to the one value that is
still passed through to wp_set_post_terms unchanged (arrays of term
IDs/names continue to be accepted there).

A new integration test exercises the three rejection paths: unknown
editorial metadata slug, unknown taxonomy, and empty term.

Test plan

• composer test:integration -- tests/Integration/CalendarMetadataAjaxTest.php passes in CI
• Editing an editorial metadata field from the calendar still saves as before
• Editing a taxonomy field (e.g. categories) from the calendar still saves as before