Plugin Security - Notify plugin committers when a new committer is added

[dd32]

To ensure that plugin authors are aware of what's happening with the plugin they're a committer for, we should email existing committers when a new committer is added to a plugin they're a committer for.

The list of committers for a plugin is fairly hidden, and unless an author was to actually look at the list, it's impossible to know that another user has been added until they receive a commit notification.

This would primarily prevent a compromised account being used to add a committer.

Suggested Email that needs some wording work:

From: WordPress Plugins <plugins@...>
Subject: New Committer added to {$plugin_name}

G'Day {$user_login}!

{$new_committer} has been added as a committer to {$plugin_name} by {$committer_who_added_user}.

The following people now have write-access to {$plugin_name}:
 * {$me}
 * {$myself}
 * {$you}

You can manage this list at {$url}.

If you believe this was in error or didn't perform this action yourself,
please contact the Plugins Team immediately and ensure that your password is secure.

-- WordPress Plugins Team

[Ipstenu]

I AM FOR THIS.

Can we also do it for the following:

• adding new 'support' people
• changing plugin OWNER

(And can we auto-NOT email people if the action was done by a plugin admin? We move things around to fix 'em on the QT for folks and that would be a lot of noise).

[dd32]

Replying to Ipstenu:

• adding new 'support' people
• changing plugin OWNER

Yep! That sounds reasonable enough.

And can we auto-NOT email people if the action was done by a plugin admin?

Oh I agree on that front :)
They shouldn't get a new-committer email post-approval when the approval process adds them as a committer either.

[dd32]

changing plugin OWNER

Turns out we already have this when it happens via the self-serve tooling:

https://meta.trac.wordpress.org/browser/sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin-self-transfer.php?marks=93-102#L92

[dd32]

In 10121:

Plugin Directory: Add a notification email to committers when a new committer or support rep is added.

Fixes #5351.

[dd32]

In 10122:

Plugin Directory: Migrate the Plugin Transferred notification email to the new Email classes.

See #5351.

[dd32]

In 10124:

Plugin Directory: Convert Plugin Approved/Rejected emails over to the new Email class.

Additionally, this causes rejected emails not to be sent to blocked users and updates the text slightly.
Props Ipstenu.

See #5351.
Fixes #5354.

[dd32]

In 10125:

Plugin Directory: Rename the classes added in [10121] and [10122].

See #5351.

[dd32]

In 10126:

Plugin Directory: Rename the classes added in [10121] and [10122].

Missed file in [10125].

See #5351.

[dd32]

In 10127:

Plugin Directory: Fix typo.

Props tobifjellner.
See #5351.