test[faustwp]: relax hash_equals count assertion to avoid false positives

Principal-review nit on the source-level regression guard in
RestCallbacksTests::test_secret_comparisons_use_constant_time_hash_equals.

The previous assertion hardcoded substr_count(rest/callbacks.php,
'hash_equals') === 2, matching the exact number of hash_equals call
sites that this PR adds. Any future contributor legitimately adding
a third hash_equals call (e.g. for a new permission callback) would
trip a false-positive 'security regression' and waste debugging time
chasing a non-bug.

Switched to assertGreaterThanOrEqual(1, ...). The real revert guards
are the two assertStringNotContainsString(...) calls above, which
specifically catch the '=== $header_key' and '!== $_SERVER[...]'
patterns this PR removes. The substr_count assertion is an affirmative
check that hash_equals() is still present somewhere -- a count of >= 1
is sufficient for that purpose.

Author: josephfusco

plugins/faustwp/tests/integration/RestCallbacksTests.php

@@ -153,9 +153,14 @@ public function test_secret_comparisons_use_constant_time_hash_equals(): void {
 		$this->assertStringNotContainsString( "!== \$_SERVER['HTTP_X_FAUST_SECRET']", $graphql_callbacks,
 			'filter_introspection must use hash_equals(), not !==.' );
 
-		// And the positive: both files must contain hash_equals().
-		$this->assertSame( 2, substr_count( $rest_callbacks, 'hash_equals' ),
-			'Both rest_authorize_permission_callback and wpac_authorize_permission_callback must use hash_equals.' );
+		// And the positive: both files must contain hash_equals(). Use >= 1 rather
+		// than a hardcoded count so a future contributor adding a legitimate third
+		// hash_equals call (e.g. for a new permission callback) doesn't trip a
+		// false-positive "security regression". The not-contains assertions above
+		// are the real revert guards; these are affirmative checks that the timing-
+		// safe primitive is still present somewhere.
+		$this->assertGreaterThanOrEqual( 1, substr_count( $rest_callbacks, 'hash_equals' ),
+			'rest/callbacks.php must contain at least one hash_equals call.' );
 		$this->assertStringContainsString( 'hash_equals', $graphql_callbacks,
 			'filter_introspection must use hash_equals.' );
 	}