1.3.3

Clears the wordpress.org Plugin Check, which CI now runs against the tree git archive produces.

The findings were annotations rather than defects. php://temp is a memory stream, so the sniff demanding WP_Filesystem was matching a function name rather than a destination. Every handler on the tag screen runs after the dispatcher's check_admin_referer() and capability check, which PHPCS cannot follow across the call. The profile's submitted tags are sanitised per element by the loop that reads them, and dropped unless the catalogue recognises them. Each is now marked as such, with the reason.

One real change: the export's what parameter is unslashed and sanitised on the way in rather than only compared against a literal.

Tested up to: 7.1 — the directory treats a stale value as an error and hides the plugin from search until it is current.