Require manage_options to add a custom status

[GaryJones]

Summary

EF_Custom_Status::handle_add_custom_status() verified the form's nonce but did not re-check the user's capability, leaving the action relying on the surrounding admin page's render-time cap check. That is fragile as defence in depth: a user who obtains a valid custom-status-add-nonce (for example through an XSS chain, a shared clipboard, or a leaked form) could submit the handler directly and have a status created on their behalf, even if they lack manage_options.

This change adds an explicit current_user_can( 'manage_options' ) check immediately after the nonce is verified, mirroring the pattern already used by the migrate, edit, and delete handlers in the same class. New integration tests cover both directions: a subscriber with a valid nonce hits wp_die, and an administrator can still complete the flow end-to-end.

Test plan

• composer test — the two new tests in CustomStatusAddHandlerTest pass
• Manually submit the Add Status form as an administrator; the status is created
• Manually submit the same form as a subscriber (with a forged cap but valid nonce); the request is rejected with the "invalid permissions" message