Non–late-escaping XSS sniff

The XSS sniff that is currently a part of the standards is designed to enforce a philosophy of late escaping—everything should be escaped immediately before output. However, strict adherence to this is currently difficult, especially for themes, because of some patterns used in WordPress core. (Many WordPress functions return a string, rather than echoing it directly, and do not always escape everything that is incorporated into the output.) There are also times, like when reviewing code, where one is mostly interested in detecting low-hanging fruit, not forcing a late-escaping policy on another developer.

To remedy this, a new sniff may need to be introduced, though it is possible that the existing sniff could also be modified to have a less strict "mode". The idea would be to only flag unescaped output that incorporated known-to-be-dangerous values, like $_POST, $_GET, etc.

Related: #748, https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/pull/844#issuecomment-279714754

Read the existing XSS sniff and the discussion in related issue #748 and pull request #844's linked comment. Determine whether a new sniff or a less strict mode best fits the request, with completion defined as flagging unescaped output that incorporates known-dangerous values such as $_POST and $_GET.