Initial release: HDWebmobile Data Privacy Requests

"Request data export" and "Request account erasure" buttons on My Account,
filed through WordPress's own core personal-data request system rather
than a custom export/erasure engine. Motivated by CWE-863 (Incorrect
Authorization) in several competing GDPR/data-request plugins for
WooCommerce: a logged-in customer's request accepted an email address
directly from the request body and used THAT email -- rather than the
requester's own account email -- to create the underlying privacy
request, letting a customer submit someone else's email and initiate an
export or erasure against a stranger's data.

Closed by construction: create_request() takes a WordPress user id as its
first parameter -- never an email address -- and always derives the email
from get_userdata($user_id)->user_email. The only caller always passes
get_current_user_id(); there is no admin_post_nopriv handler at all, since
this plugin only ever acts on the account that is already authenticated.
Every request still goes through wp_create_user_request()/
wp_send_user_request() -- WordPress core's own, already-audited
confirmation-email flow -- rather than this plugin reimplementing export
or erasure itself.

Verified via a 17-case PHP unit suite -- including a direct proof that two
different real user accounts' requests never cross-contaminate emails,
an unrecognized action name and a nonexistent user id both rejected with
WP_Error, reflection confirming create_request() has no email parameter at
all, and a source check (comments stripped, avoiding a docblock
false-positive on the very sentence explaining the design) confirming no
guest-accessible request handler exists. Plugin Check clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
