Default to sanitize_text_field as the sanitize_callback

If a sanitize callback is not set, we should default to sanitize_text_field. Maybe only in contexts where unfiltered_html is not allowed.

Start by locating where sanitize_callback defaults are selected and how the plugin handles contexts where unfiltered_html is not allowed. Review any existing sanitization tests and compare omitted callbacks with explicitly supplied callbacks. Done means the intended default behavior and its coverage are settled for both security contexts.

Written by the indexing model from the issue text.