Normalize malformed enabled-provider user meta before array operations

Problem

Two_Factor_Core::get_enabled_providers_for_user() assumes _two_factor_enabled_providers is always an array. Malformed legacy/imported/corrupted meta can be scalar or object-shaped; the subsequent array_intersect() then fatals instead of failing closed.

Reproductions

Set _two_factor_enabled_providers to each of the following and call enabled/available provider resolution:

• String provider key
• Integer-backed scalar
• Serialized object / stdClass

Observed at class-two-factor-core.php around line 671: array_intersect() receives a non-array and throws a TypeError.

Expected

Normalize untrusted persisted meta to a bounded array of provider keys before array operations. Malformed state should not fatal admin lists, profile rendering, CLI, REST, or login. Authentication must remain fail-closed when stored state claims 2FA but cannot resolve safely.

Evidence

Found during an isolated multisite fuzz review of #933:

• Seed: 9338501
• 5,000 randomized provider states
• 500 state transition sequences
• Reproduced consistently for string, numeric scalar, and object values

This appears pre-existing and is separate from #933’s return-path fix.

Start in class-two-factor-core.php around get_enabled_providers_for_user() and inspect the array_intersect() call against the listed scalar and stdClass reproductions. Done means malformed persisted provider metadata no longer causes fatals in admin, profile, CLI, REST, or login flows, while authentication remains fail-closed when the state cannot be resolved safely.