Custom IniSet Sniff to allow for certain safelisted options

## Describe the solution you'd like

VIPCS could benefit from having a custom IniSet sniff...similar to https://github.com/WordPress/WordPress-Coding-Standards/blob/41f5a9c66ff814863bc479fb52fd6cd1abc87e28/WordPress/Sniffs/PHP/IniSetSniff.php#L55-L65, but we want to be able to customize the whitelist property for the below values:

- session.cookie_httponly
- session.cookie_secure
- session.use_only_cookies

WP already manages sessions but we have some clients that want to control PHP sessions via custom code.

## What code should *not* be reported as a violation?

```
ini_set('session.cookie_httponly', true);
ini_set('session.cookie_secure', true);
ini_set('session.use_only_cookies', true);
```

## Additional context
https://github.com/WordPress/WordPress-Coding-Standards/issues/1993

首先，将引用的 WordPress/Sniffs/PHP/IniSetSniff.php 实现（尤其是第 55-65 行）与 VIP-Coding-Standards sniff 结构进行比较。确认 whitelist 的配置方式，并找出相关的 sniff 测试。完成标准是，列出的三个 session 选项能够被接受，而其他不允许的 ini_set 调用仍然属于违规。

由索引模型根据 Issue 内容生成。