Security/Mustache: improve tests

Make sure some tests contain more complex PHP interpolated expressions to ensure this doesn't lead to false positives.

Note: as I haven't been able to come up with valid code samples which would confuse the Mustache syntax with PHP interpolated expressions, I have not implemented the use of the `TextStrings::stripEmbeds()` method.

Author: jrfnl

WordPressVIPMinimum/Tests/Security/MustacheUnitTest.inc

@@ -23,11 +23,11 @@ echo '<a href="{{href}}">{{&data}}</div></a>'; // NOK: data.
 <div class="wp-block-group"><!-- wp:heading {"textAlign":"center","style":{"spacing":{"margin":{"top":"0","right":"0","bottom":"var:preset|spacing|medium","left":"0"}}}} --><!-- OK. -->
 
 <?php
-echo "<a href='$href'>{{{data}}}</div></a>"; // NOK: data.
+echo "<a href='${foo->{$baz}}'>{{{data}}}</div></a>"; // NOK: data.
 
 echo <<<HERE
 <script type="text/html" id="tmpl-example">
-<a href="$href">{{{data}}}</div></a><!-- NOK: data. -->
+<a href="${(href)}">{{{data}}}</div></a><!-- NOK: data. -->
 <a href="{{href}}">{{&data}}</div></a><!-- NOK: data. -->
 {{=<% %>=}} <!-- NOK: delimiter change -->
 </script>