fix: Exclude test files from WordPress.Security checks

- Test and bootstrap files don't need output escaping
- Focus security checks on production code only

Author: miguelcolmenares

phpcs.xml

@@ -47,6 +47,12 @@
     <!-- WordPress Security (Critical for WordPress integration) -->
     <rule ref="WordPress.Security.EscapeOutput"/>
     <rule ref="WordPress.Security.ValidatedSanitizedInput"/>
+    
+    <!-- Exclude WordPress.Security checks from test files -->
+    <rule ref="WordPress.Security">
+        <exclude-pattern>tests/bootstrap.php</exclude-pattern>
+        <exclude-pattern>tests/fixtures/*</exclude-pattern>
+    </rule>
 
     <!-- WordPress i18n (Text domain validation) -->
     <rule ref="WordPress.WP.I18n">