Initial release: HDWebmobile Post-Purchase Upsell

A one-click upsell offer on the order-received page, accepted into a
brand-new, separate order. Motivated by CWE-639 (Authorization Bypass
Through User-Controlled Key, an IDOR) in a competing post-purchase upsell
plugin: its "accept" endpoint took the original order id straight from the
request and trusted it to determine whose order -- and billing/shipping
address -- the upsell attached to, without verifying the requester
actually owned that order.

Closed by construction: resolve_order() requires both the real order id
AND its real order key to match, via hash_equals(), the same check
WooCommerce's own guest-order lookup performs -- confirmed by reading
includes/shortcodes/class-wc-shortcode-checkout.php directly. The offer is
only ever rendered from woocommerce_thankyou, which core's own
templates/checkout/thankyou.php only fires after that same check has
already passed for the page view, and this plugin independently
re-verifies the pair anyway rather than trusting the page context alone.
The upsell price is always computed fresh from the product's real regular
price and the configured discount; accepting is idempotent via an
order-meta flag set before the new order is even created, so a retried
accept can never create a duplicate.

Verified via a 22-case PHP unit suite -- including the literal IDOR this
plugin closes (a real key belonging to a DIFFERENT order never resolves
the target order), a wrong-key/right-id case, idempotent accept, a real
new order's total matching the server-computed discount exactly (a
genuine WooCommerce API pitfall was caught and fixed here: get_item()
returns a separate object instance from add_product()'s own internal
item, so mutating it silently never reached calculate_totals() -- fixed
by passing the price directly via add_product()'s own $args), and
reflection confirming the order-resolution and order-creation methods
accept nothing but an id/key pair or a real WC_Order. Plugin Check clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
