Theme previews: Escape theme activation nonce for output.

[peterwilsoncc]

What?

Adds escaping to the nonce output used for activation of themes.

Why?

As the WordPress nonce functions are pluggable, plugins can introduce custom implementations. While the core implementation only uses alphanumeric characters, a custom version may use any number of special characters.

How?

Wraps output in wp_json_encode() -- note the removal of the quotes is intentional as the function adds them automatically.

Testing Instructions

1. Add an mu-plugin that replaces the nonce create function function wp_create_nonce() { return "';"; }
2. Visit the theme preview page (be aware this won't load entirely correctly due to the incomplete nonce implimentation)
3. In the console ensure the constant is set correctly

   >> WP_BLOCK_THEME_ACTIVATE_NONCE
   "';" 
   

4. Delete the mu-plugin so you don't end up wondering why everything is broken.

Testing Instructions for Keyboard

N/A -- no UI change.

Screenshots or screencast

[ramonjd]

LGTM

Nonce:

With wp_create_nonce overwritten: