Escape pattern preview content

[mike-day]

This PR uses wp_kses_post to escape content used for pattern preview iFrames. This is just to help protect against malicious scripts that might be embedded in the pattern.

---

Before (<script> tags allowed):

---

After (<script> tags have been stripped):

---

How to test

1. Checkout the branch
2. Make sure previews load as expected
3. If you are really enterprising, try to add an additional script — it should not execute

[kienstra]

Good idea.

Sometimes post_content will have <script> tags, as even the Custom HTML block allows <script>.

If this ever becomes a problem, we can address it then. A user mentioned a problem from too much escaping in GCB.

But this is good now. It's always easier to lighten escaping that to tighten it.

[mike-day]

Thanks @kienstra! Agreed that we can always lighten restrictions if it becomes an issue.