Security/Mustache: prevent false positive on partial text

Includes test.

Author: jrfnl

WordPressVIPMinimum/Sniffs/Security/MustacheSniff.php

@@ -71,7 +71,7 @@ public function process_token( $stackPtr ) {
 			}
 		}
 
-		if ( strpos( $this->tokens[ $stackPtr ]['content'], 'SafeString' ) !== false ) {
+		if ( strpos( $this->tokens[ $stackPtr ]['content'], '.SafeString' ) !== false ) {
 			// Handlebars.js Handlebars.SafeString does not get escaped.
 			$message = 'Found Handlebars.SafeString call which does not get escaped.';
 			$this->phpcsFile->addWarning( $message, $stackPtr, 'SafeString' );

WordPressVIPMinimum/Tests/Security/MustacheUnitTest.inc

@@ -49,3 +49,6 @@ $m = '%>=}} {{=<%'; // Incorrect order, not a delimiter change.
 
 // Correctly recognize mid-line delimiter change.
 $m = '{{default_tags}} {{=<% %>=}} <% erb_style_tags %> <%={{ }}=%> {{ default_tags_again }}'; // NOK: delimiter change.
+
+// Prevent false positives on SafeString being a partial name.
+echo 'MySafeString';