Check $user type to avoid fatal error.

There are some rare cases where `rest_preload_api_request(Array, '/wp/v2/users/me...')` on a new user results in the `get_userdata()` calls in `\WordPressdotorg\Two_Factor\register_user_fields` returning `false`. It's not easy to reproduce, so handling it gracefully is good enough as a solution.

See https://wordpress.slack.com/archives/G02QB4059/p1675309698126049 and the 3 that followed it.

tests/test-wporg-two-factor.php

@@ -163,6 +163,13 @@ public function data_user_requires_2fa() : array {
 		);
 	}
 
+	/**
+	 * @covers WordPressdotorg\Two_Factor\user_requires_2fa
+	 */
+	public function test_invalid_user_doesnt_require_2fa() : void {
+		$this->assertFalse( user_requires_2fa( false ) );
+	}
+
 	/**
 	 * @covers WordPressdotorg\Two_Factor\redirect_to_2fa_settings
 	 */

wporg-two-factor.php

@@ -134,10 +134,17 @@ function remove_capabilities_until_2fa_enabled( array $allcaps, array $caps, arr
 
 /**
  * Check if the user has enough elevated privileges to require 2FA.
+ *
+ * @param WP_User $user
  */
-function user_requires_2fa( WP_User $user ) : bool {
+function user_requires_2fa( $user ) : bool {
 	global $trusted_deputies, $wcorg_subroles;
 
+	// This shouldn't happen, but there've been a few times where it has inexplicably.
+	if ( ! $user instanceof WP_User ) {
+		return false;
+	}
+
 	// @codeCoverageIgnoreStart
 	if ( ! array_key_exists( 'phpunit_version', $GLOBALS ) ) {
 		// 2FA is opt-in during beta testing.