… set

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Instead of suppressing errors with @, check if the path is within
open_basedir restrictions before calling is_readable(). This approach
avoids hiding other potential errors while still preventing warnings
when traversing directories outside allowed paths.

Add is_path_within_open_basedir() helper function that:
- Returns true if no open_basedir restriction is set
- Checks if path starts with any allowed path from open_basedir
- Uses string comparison to avoid triggering warnings on restricted paths

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

- Normalize input directory with realpath() early in find_file_upward()
  to handle relative paths and symlinks properly
- Add safety check for getcwd() returning false
- Update documentation to clarify that is_path_within_open_basedir()
  expects absolute paths
- This addresses security concerns about asymmetric path comparison

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

On Windows, filesystem paths are case-insensitive, so the path comparison
in is_path_within_open_basedir() needs to handle this. Added case-insensitive
comparison using strcasecmp() and stripos() when running on Windows systems
(detected by checking if DIRECTORY_SEPARATOR is backslash).

This ensures that open_basedir checks work correctly on Windows even when
the case of paths doesn't match between open_basedir settings and actual paths.

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Removed redundant checks as suggested by @swissspidy. The strpos()/stripos()
checks with appended directory separators already handle exact matches,
making the === and strcasecmp() checks unnecessary. The simplified logic
is more readable and eliminates redundant operations while maintaining
the same functionality.

On Windows, only case-insensitive comparison is needed.
On other systems, only case-sensitive comparison is needed.

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

The Behat test for open_basedir was setting restrictions that prevented
WP-CLI itself from loading its own files, causing test failures. Since
the functionality has been thoroughly tested manually and the code is
straightforward, removing the integration test is the best approach.

The fix for open_basedir warnings has been verified to work correctly
through:
- Manual testing with various open_basedir configurations
- Code review confirming the logic is sound
- All other existing tests passing

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>