CampTix: hide unknown attendees from the public attendees list - #2117

What

hide_unconfirmed_attendees() keeps unclaimed tickets off the public [camptix_attendees] list, but it only excludes attendees whose username is the [[ unconfirmed ]] placeholder. The buyer's own row keeps the buyer's real username even when it was marked as an unknown attendee (add_username_to_attendee_object()), so it gets past the filter and shows up as Unknown Attendee.

This PR also excludes the unknown-attendee placeholder email (UNKNOWN_ATTENDEE_EMAIL), the same way prevent_unknown_attendees_viewing_private_content() already identifies these records. It's a query change, so it hides the rows that are already on live sites too, and no data migration is needed.

It also bumps the [camptix_attendees] cache buster. The cache key only hashes the shortcode attributes, so without the bump sites would keep serving the cached list with these rows for up to 3 hours (1 day on archived sites) after deploy.

Fixes #2114. See #1480, #1721.

This PR doesn't change checkout. Making an unknown buyer row get the placeholder username (option 2 in #2114) would only affect new purchases, and it narrows what #1480 widened, so I've left it for a separate follow-up.

Tests

These are the first tests for the Require Login addon. tests/addons/test-require-login.php renders the real shortcode against real attendee posts:

• a confirmed attendee is listed (a control, so the other tests can't pass vacuously);
• an attendee with the [[ unconfirmed ]] username is hidden (existing behaviour, now covered);
• an unknown attendee with a real username is hidden. This test fails without the fix.

To make that possible, the CampTix test bootstrap now enables the addon through camptix_default_addons, the same way camptix-tweaks does on every WordCamp site. Addons have to be registered before camptix_init, so a test can't load it itself. One existing test, test_insert_attendee_drafts_aborts_and_cleans_up_when_a_draft_cannot_be_written, builds checkout attendees by hand, so it now sets username on them, as the addon does during a real checkout. Without that, the addon's camptix_checkout_update_post_meta callback wrote an undefined-property warning to the error log.

Checked locally:

• Mutation: with the hide_unconfirmed_attendees hook removed, both "hidden" tests fail.
• Full suite on this branch vs. clean production in the local harness: 1797 vs. 1794 tests (+3 tests, +5 assertions), and the set of failing tests is identical in both runs. Those failures already exist in the local environment, and none are in CampTix. The PHP warnings also match clean production once the fixture above is fixed.
• CampTix suite: 163 tests, OK (5 skipped, which need intl).
• .github/bin/phpcs-branch.php against production: clean.

How to test the changes in this Pull Request:

1. On a WordCamp site (Require Login is active), create a published tix_attendee post with tix_first_name = Unknown, tix_last_name = Attendee, tix_email = unknown.attendee@example.org and tix_username = any real username. That's what checkout stores when the buyer's own row is marked as unknown (see CampTix: "Unknown Attendee" tickets show up on the public attendees page #2114 for how that happens).
2. Visit the page with [camptix_attendees] (e.g. /attendees/).
3. Before this PR, "Unknown Attendee" is listed. After it, it isn't, and confirmed attendees still are.
4. Or run phpunit --filter Test_Camptix_Require_Login_Addon.