Fix: add missing sanitize_text_field() on provider input in login_form_validate_2fa()

`login_form_revalidate_2fa()` already applies sanitize_text_field( wp_unslash() ) to
the same $_REQUEST['provider'] input at line 1703. The parallel validate handler on
line 1563 was missing the sanitize_text_field() wrapper — only wp_unslash() was called.

This brings the two handlers in line with each other and with WordPress-VIP-Go coding
standards (ValidatedSanitizedInput.InputNotSanitized).

The provider value flows into get_provider_for_user() as an array key lookup, so
there is no functional exploit path — this is a defensive coding and PHPCS compliance fix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: thisismyurl

class-two-factor-core.php

@@ -1560,7 +1560,7 @@ public static function rest_api_can_edit_user_and_update_two_factor_options( $us
 	public static function login_form_validate_2fa() {
 		$wp_auth_id      = ! empty( $_REQUEST['wp-auth-id'] ) ? absint( $_REQUEST['wp-auth-id'] ) : 0;
 		$nonce           = ! empty( $_REQUEST['wp-auth-nonce'] ) ? wp_unslash( $_REQUEST['wp-auth-nonce'] ) : '';
-		$provider        = ! empty( $_REQUEST['provider'] ) ? wp_unslash( $_REQUEST['provider'] ) : '';
+		$provider        = ! empty( $_REQUEST['provider'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['provider'] ) ) : '';
 		$redirect_to     = ! empty( $_REQUEST['redirect_to'] ) ? wp_unslash( $_REQUEST['redirect_to'] ) : '';
 		$is_post_request = ( 'POST' === strtoupper( $_SERVER['REQUEST_METHOD'] ) );
 		$user            = get_user_by( 'id', $wp_auth_id );