Enforce wp_slash() on functions that expect slashed data

Since WordPress forces global input vars to get magic quoted, any access to them should pass through wp_unslash(). Likewise, any data data sent into a function that expects pre-slashed input should require an explicit wp_slash().

For example, wp_unslash() and wp_slash() could be enforced in situations like this:

$title = sanitize_text_field( wp_unslash( $_POST['title'] ) );
// ...
wp_insert_post( wp_slash( array(
    'post_title' => $title,
) ) );

As a WordPress-Extra rule, this will help enforce a discipline of unslashing, sanitizing, and slashing when slashing is required (e.g. in wp_update_post(), update_post_meta(), etc). It's easy to forget and for slashing to sneak in or to get stripped out, \\o/ o/, yay.

https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/pull/395 implements the sniff for wp_unslash()

Start by reviewing the WordPress-Extra rule described in the issue and the referenced PR #395 for the existing wp_unslash() sniff. Trace how WordPress functions such as wp_insert_post(), wp_update_post(), and update_post_meta() are represented in the ruleset, then verify that the completed rule catches missing wp_slash() usage without flagging valid input.