test(config): add coverage for email/locale/general security fixes (#4782)

Add ConfigControllerTest covering validation added to protect
config save endpoints from injection and bypass attacks.

- Mailpath validation: accept legit sendmail paths (with dots,
  trailing args), require mailpath when protocol is sendmail,
  reject command injection via shell metacharacters (e.g.
  semicolon) for both sendmail and non-sendmail protocols
- postSaveLocale: verify payment_reference_code_min/max bounds
  (reject non-numeric, zero, negative, max < min; accept valid
  and min==max cases)
- postSaveLocale: verify language_code allow-list enforcement
  against path traversal (forward/backslash variants), unknown
  languages, and case-mismatched codes (GHSA-related hardening)
- postSaveGeneral: begin coverage of theme validation with a
  reusable base payload builder

Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>

tests/Controllers/ConfigControllerTest.php

@@ -5,12 +5,17 @@ namespace Tests\Controllers;
 use CodeIgniter\Test\CIUnitTestCase;
 use CodeIgniter\Test\DatabaseTestTrait;
 use CodeIgniter\Test\FeatureTestTrait;
+use Config\OSPOS;
+use Tests\Support\DatabaseBootstrapTrait;
+use Tests\Support\EmployeeFixtureTrait;
 use Tests\Support\TaxFixtureTrait;
 
-class ConfigTest extends CIUnitTestCase
+class ConfigControllerTest extends CIUnitTestCase
 {
     use DatabaseTestTrait;
+    use DatabaseBootstrapTrait;
     use FeatureTestTrait;
+    use EmployeeFixtureTrait;
     use TaxFixtureTrait;
 
     protected $migrate     = true;
@@ -20,12 +25,20 @@ class ConfigTest extends CIUnitTestCase
 
     protected function setUp(): void
     {
+        $this->resetDatabaseOnce();
+
         parent::setUp();
+
+        config(OSPOS::class)->update_settings();
     }
 
     protected function resetSession(): void
     {
-        $this->withSession(['person_id' => 1, 'menu_group' => 'office']);
+        $personId = $this->createEmployee(grants: [
+            ['permission_id' => 'config', 'menu_group' => 'office'],
+        ]);
+
+        $this->withSession(['person_id' => $personId, 'menu_group' => 'office']);
     }
 
     // ========== Valid Mailpath Tests ==========