Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`

`finalize_item()` stores the attacker-supplied `sub_sizes[].file` string verbatim into `_wp_attachment_metadata['sizes'][<name>]['file']` — no `sanitize_file_name()`, no `pattern`, no `sanitize_callback`.

				$metadata['sizes'] = $metadata['sizes'] ?? array();

				$metadata['sizes'][ $image_size ] = array(
					'width'     => $sub_size['width'] ?? 0,
					'height'    => $sub_size['height'] ?? 0,
					'file'      => $sub_size['file'] ?? '',
					'mime-type' => $sub_size['mime_type'] ?? '', …