fix: gate the network column renderers on the network capability - #467

Fixes #137

Both Network Admin render callbacks returned network-wide presence to any caller, since only the column registration was gated. That holds while ours is the only thing that can put a column called presence_online on those screens, which is not a property this plugin controls. Called as a subscriber:

Notes:

• Gated rather than pinned as unreachable with a test, which was the open question on the issue. Two lines, it matches every other entry point in those files, and unreachability stops being true the moment another plugin registers the name.
• The cross-site denial the issue asks for already holds, so that test is a regression guard rather than a fix. Same for the site-scoped read.
• test_users_column_shows_a_dash_for_an_offline_user called the renderer uncapped and passed because the user was offline. It becomes a network admin first, which is what it always meant to assert.
• The wp_presence_network_capability docblock now says what a lowered value grants.

Testing:

• npm run test:multisite: 466 tests, 986 assertions, 3 skipped.
• npm test: 466 tests, 739 assertions, 131 skipped.
• composer phpcs: clean.
• Mutations: caps read from the main site inside the switch fails the denial test, the read pinned to $wpdb->base_prefix fails the isolation test, deleting either gate fails that column's test, and nothing else moves.
• Browser: an mu-plugin filtering the capability to do_not_allow and registering its own presence_online column, which is the third-plugin case above. On main that viewer sees the avatar stacks and the site names; on this branch both columns are empty. A super admin sees no change either way.