Add - Pin the sanitize_key() collapse cases in state_compact().

Requested independently by both reviewers on the rate-table seam PR: the changelog
cites a non-Latin state as the motivating case, but no provider row exercised one,
so the behavior rested on reasoning rather than on a test.

Adds five rows. Three collapse to empty outright (Cyrillic, CJK, a bare
diacritic). Two collapse only partially -- 'IF' with a circumflex becomes 'F',
'AL' with a ring above becomes 'L' -- and those are the dangerous shape, because
the result is a shorter but still perfectly plausible state code. That is exactly
the duplication path this seam exists to close: the row is stored under the
collapsed value and looked up under the raw one, so it can never be found again
and a fresh row is inserted on every calculation.

Expected values were read off WordPress's own sanitize_key() rather than derived
by hand; the test's existing second assertion re-checks that agreement per row.
All five fail against the pre-migration str_replace() implementation.

Author: bartech

tests/php/Tax/test-address.php

@@ -834,17 +834,39 @@ public function test_state_compact_mirrors_core_storage_normalisation( $raw, $ex
 	/**
 	 * Data provider for `test_state_compact_mirrors_core_storage_normalisation`.
 	 *
+	 * The non-ASCII rows are the ones the changelog's motivating case rests on, and they
+	 * are the reason the old `str_replace( ' ', '' )` lookup was unsafe rather than merely
+	 * incomplete. `sanitize_key()` drops every byte outside `[a-z0-9_-]`, so a state can
+	 * collapse to `''` outright (Cyrillic, CJK, a bare diacritic) or — worse — collapse
+	 * *partially* to a shorter ASCII string that is a perfectly plausible state code. The
+	 * partial cases are the duplication risk: the row is stored under the collapsed value
+	 * and searched for under the raw one, so it can never be found again and a fresh row
+	 * is inserted every calculation.
+	 *
+	 * Expected values are what WordPress's own `sanitize_key()` produces, read off the
+	 * function rather than reasoned about — the test's second assertion re-checks that
+	 * agreement on every row.
+	 *
 	 * @return array<string, array{0: string, 1: string}>
 	 */
 	public function state_compact_provider() {
 		return array(
-			'already canonical' => array( 'NY', 'NY' ),
-			'lower case'        => array( 'ny', 'NY' ),
-			'internal space'    => array( 'N Y', 'NY' ),
-			'periods'           => array( 'N.Y.', 'NY' ),
-			'hyphen kept'       => array( 'AB-12', 'AB-12' ),
-			'digits kept'       => array( 'A1', 'A1' ),
-			'empty'             => array( '', '' ),
+			'already canonical'         => array( 'NY', 'NY' ),
+			'lower case'                => array( 'ny', 'NY' ),
+			'internal space'            => array( 'N Y', 'NY' ),
+			'periods'                   => array( 'N.Y.', 'NY' ),
+			'hyphen kept'               => array( 'AB-12', 'AB-12' ),
+			'digits kept'               => array( 'A1', 'A1' ),
+			'empty'                     => array( '', '' ),
+
+			// Collapse to empty — nothing survives sanitize_key().
+			'cyrillic collapses'        => array( 'ЛЕН', '' ),
+			'cjk collapses'             => array( '东京', '' ),
+			'bare diacritic collapses'  => array( 'Ö', '' ),
+
+			// Partial collapse — the dangerous shape: a shorter, still-plausible code.
+			'accented latin part-drops' => array( 'ÎF', 'F' ),
+			'ring above part-drops'     => array( 'ÅL', 'L' ),
 		);
 	}