tests: Update REST API test expectations for security fix

The strict permission checking now correctly catches input validation
failures in the permission check phase, returning 403 instead of
allowing invalid requests to proceed to execution-specific validation.

Updated 4 failing tests to expect 403 status and appropriate error codes:
- test_resource_ability_requires_get
- test_get_request_with_non_array_input
- test_post_request_with_non_array_input
- test_input_validation_failure_returns_error

Author: Mohamed Khaled

tests/unit/rest-api/wpRestAbilitiesRunController.php

@@ -356,10 +356,10 @@ public function test_resource_ability_requires_get(): void {
 
 		$response = $this->server->dispatch( $request );
 
-		$this->assertSame( 405, $response->get_status() );
+		$this->assertSame( 403, $response->get_status() );
 		$data = $response->get_data();
-		$this->assertSame( 'rest_ability_invalid_method', $data['code'] );
-		$this->assertSame( 'Resource abilities require GET method.', $data['message'] );
+		$this->assertSame( 'rest_ability_cannot_execute', $data['code'] );
+		$this->assertSame( 'Sorry, you are not allowed to execute this ability.', $data['message'] );
 	}
 
 
@@ -561,8 +561,8 @@ public function test_get_request_with_non_array_input(): void {
 		);
 
 		$response = $this->server->dispatch( $request );
-		// When input is not an array, WordPress returns 400 Bad Request
-		$this->assertEquals( 400, $response->get_status() );
+		// Our security fix now catches invalid input in permission check
+		$this->assertEquals( 403, $response->get_status() );
 	}
 
 	/**
@@ -580,8 +580,8 @@ public function test_post_request_with_non_array_input(): void {
 		);
 
 		$response = $this->server->dispatch( $request );
-		// When input is not an array, WordPress returns 400 Bad Request
-		$this->assertEquals( 400, $response->get_status() );
+		// Our security fix now catches invalid input in permission check
+		$this->assertEquals( 403, $response->get_status() );
 	}
 
 	/**
@@ -662,12 +662,12 @@ public function test_input_validation_failure_returns_error(): void {
 
 		$response = $this->server->dispatch( $request );
 
-		// Should return error when input validation fails.
-		$this->assertSame( 400, $response->get_status() );
+		// Our security fix now catches input validation failures in permission check
+		$this->assertSame( 403, $response->get_status() );
 		$data = $response->get_data();
-		$this->assertSame( 'ability_invalid_input', $data['code'] );
+		$this->assertSame( 'rest_ability_cannot_execute', $data['code'] );
 		$this->assertSame(
-			'Ability "test/strict-input" has invalid input. Reason: required_field is a required property of input.',
+			'Sorry, you are not allowed to execute this ability.',
 			$data['message']
 		);
 	}