Customize: Don't let hardcoded regex override customize_allowed_urls filter

[abhi3315]

Trac ticket: https://core.trac.wordpress.org/ticket/65030

Summary

The Customizer decides link previewability with a hardcoded /\/wp-(admin|includes|content)(\/|$)/ regex, which blocks the preview for sites whose home URL path contains /wp-content/, even when the URL is allowed via customize_allowed_urls. This PR exports the non-previewable path prefixes from PHP to JS instead, following the approach of WP_URL_Pattern_Prefixer::get_default_contexts().

• New WP_Customize_Manager::get_excluded_url_paths() derives prefixes from admin_url(), includes_url(), content_url(), plugins_url(), and wp_get_upload_dir(), exported as url.excludedPaths in both settings payloads. URLs on another host (e.g. CDN-filtered uploads) and paths at or above the home path are skipped.
• New wp.customize.utils.isExcludedPath() in customize-base.js is the single matcher used by isLinkPreviewable() and the previewUrl setter. Prefixes are anchored to the start of the pathname, repeated slashes are collapsed, and it falls back to the old regex when no paths are supplied.
• The wp-login.php/wp-signup.php and admin-ajax.php checks are unchanged (filename-based, subdirectory-safe).

A site installed at /wp-content/subsite/ now exports /wp-content/subsite/wp-admin/ etc., so its own home URL no longer collides with any excluded prefix.

Behavior changes

Matching is now anchored to this install's real locations rather than wp-admin/wp-content appearing anywhere in a path. So: same-host paths of other installs (e.g. /site2/wp-admin/ from a subdirectory multisite main site) become previewable, front-end permalinks like /blog/wp-content/ are no longer wrongly blocked, and relocated content directories are now correctly excluded. Filtered URL functions are trusted as-is (a renamed admin path excludes the renamed path, not the literal /wp-admin/).

Tests

PHPUnit: default paths contract, the subdirectory repro, the guards, and export wiring (passes single-site and multisite). QUnit: new module covering the JS matcher.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Fable 5
Used for: Analysis, implementation, and test writing. Final implementation reviewed and verified by me.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props abhi3315.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.