fix(comments): add Customizer toggle for comment meta position

[faisalahammad]

Summary

Adds a Customizer radio control so site editors can choose whether comment author meta (avatar, name, date) appears above or below the comment content. Defaults to above for backward compatibility.

Fixes #2310

Changes

classes/class-newspack-walker-comment.php

The walker now buffers the comment-meta footer and comment-content div into separate variables via output buffering, then emits them in the order determined by the new comment_meta_position theme mod.

inc/customizer.php

New comment_meta_position setting added to the existing Comments Settings section with a radio control: "Above comment content" / "Below comment content".

Testing

Test 1: Default (above)

1. Activate theme, visit a post with comments
2. Comment author info appears above the comment text ✓

Test 2: Switch to below

1. Customize → Comments Settings → select "Below comment content"
2. Publish, refresh post
3. Comment author info now appears below the comment text ✓

Test 3: Switch back

1. Customize → select "Above comment content"
2. Publish, refresh
3. Comment author info returns above the text ✓

[dkoo]

@faisalahammad Thanks for the new comment meta position option! The new option works as described and passes in-browser testing. Before we can merge, please address feedback in the inline comments below:

[dkoo]

🛑 Blocker: Sanitizer is too permissive for a radio setting

'sanitize_callback' => 'sanitize_text_field' accepts any string. Walker logic at class-newspack-walker-comment.php:105 is 'above' === $value ? … : (below), so any non-above value silently flips to "below" — weakens backward-compat.

Suggested fix: Use the existing newspack_sanitize_radio helper to sanitize values against the choices registered via wp_customize->add_control().

[dkoo]

🔴 Blocker: phpcs:ignore is too eager

Since we're now directly echoing the entire buffered $comment_meta and $comment_content, these phpcs:ignore statements will silence the sniff for any future unsafe addition to the buffered region.

Suggested fix: wrap these in another wp_kses_post() to ensure safe output, or at the very least provide a more detailed comment indicating the potential security hole, e.g. ensure all buffered output is escaped above.

[dkoo]

🟡 Suggested fix: Exception-safe buffering

Wrap each ob_start/ob_get_clean pair in try { … } finally { … } so a throwing filter (comment_text, get_avatar, etc.) can't leave buffers stuck on the stack.

[dkoo]

Nit: prefer sentence casing over title casing for option labels.

Suggested change

	'label' => esc_html__( 'Comment Meta Position', 'newspack-theme' ),
	'label' => esc_html__( 'Comment meta position', 'newspack-theme' ),

[faisalahammad]

Thanks for the thorough review, @dkoo! I've addressed all four points:

1. Sanitizer — Switched from sanitize_text_field to newspack_sanitize_radio so invalid values fall back to the default instead of silently flipping to "below."
2. phpcs:ignore — Removed all four phpcs:ignore statements and wrapped the buffered output in wp_kses_post() instead.
3. Exception-safe buffering — Added try/finally blocks with level tracking around both ob_start/ob_get_clean pairs to prevent buffer leaks if a filter throws.
4. Label casing — Changed "Comment Meta Position" to "Comment meta position" for sentence casing.

[dkoo]

Thanks for the changes, @faisalahammad! This is looking good.