Ensure capabilities are checked in metabox saves

• For each metabox registered with add_meta_box, flag if the save callback does not contain a cap check.

If the callback is a method like array( $obj, 'method' ), it will be to difficult to check programatically. However, if the method is for $this or if a bare global function name or closure is used, then it should be straightforward to locate the function in the same file.

PHPUnit would be a better way to check if a function calls current_user_can, as a test could run and then check to see if the map_meta_cap hook ran during the function's execution.

Per the VIP code review guidelines:

Capability checks need to validate that users can take the requested actions.

Start by locating the rule that inspects registrations made with add_meta_box and review how callback forms are represented. Use the listed cases—$this methods, bare global functions, and closures—as the initial scope, and investigate PHPUnit coverage using current_user_can and the map_meta_cap hook. Done means callbacks that can be inspected are flagged when they lack a capability check.