Custom sanitizing rules ignored

Bug Description

When I run vendor/bin/phpcs class-foo.php, I get this error:

------------------------------------------------------------------------------
FOUND 1 ERROR AFFECTING 1 LINE
------------------------------------------------------------------------------
 11 | ERROR | Detected usage of a non-sanitized input variable: $_POST['foo']
------------------------------------------------------------------------------

I would expect the error to be suppressed because sanitize_promos_array is whitelisted.

Minimal Code Snippet

<?php

class Foo {

	public static function sanitize_promos_array( $input ) {
		// sanitize me
		return $input;
	}

	public static function bar() {
		$taxonomies = isset( $_POST['foo'] ) ? self::sanitize_promos_array( wp_unslash( $_POST['foo'] ) ) : []; // phpcs:ignore WordPress.VIP.SuperGlobalInputUsage.AccessDetected,WordPress.Security.NonceVerification.Missing
	}

}

phpcs.xml:

<?xml version="1.0"?>
<ruleset name="MyRuleSet">
	<rule ref="WordPress-Extra" />
	<rule ref="WordPress.Security.ValidatedSanitizedInput">
		<properties>
			<property name="customSanitizingFunctions" type="array">
				<element value="sanitize_promos_array" />
				<element value="sanitize_announcements_array" />
			</property>
		</properties>
	</rule>
</ruleset>

Environment

Additional Context (optional)

This worked fine with WPCS 1.x. The rule was defined like so:
	<rule ref="WordPress.Security.ValidatedSanitizedInput">
		<properties>
			<property name="customSanitizingFunctions" value="sanitize_promos_array,sanitize_announcements_array" type="array" />
		</properties>
	</rule>

Start by running the provided vendor/bin/phpcs command with the phpcs.xml configuration and inspect the implementation of WordPress.Security.ValidatedSanitizedInput. Trace how the customSanitizingFunctions property is read and applied, then add or update a regression test showing that sanitize_promos_array suppresses the reported error.