Media/Admin: migrate raw inline scripts to wp_print_inline_script_tag()

[tinhien11]

Description

Follows up on the Trac ticket discussion (comment 19): migrates the raw inline
<script> blocks in wp-admin/admin-header.php and wp-admin/includes/media.php to
wp_print_inline_script_tag(), matching the patterns established in r60909 / r60913.

This is a prerequisite slice for the Content Security Policy rollout discussed in Trac #59446: once all admin inline scripts route through the script tag API, the
wp_inline_script_attributes filter becomes the single point where a per-request nonce can be attached.

Changes

• wp-admin/admin-header.php: the global admin JS (addLoadEvent, ajaxurl, pagenow, typenow,
  adminpage, locale separators, isRtl) and the no-js -> js body-class replacement are now printed via wp_print_inline_script_tag().
• wp-admin/includes/media.php: 10 of the 11 inline script blocks (send-to-editor handoff, plupload init, preloaded media item lists, wpOnload() trigger, post_id echo) migrated. The disable_captions conditional and the dynamic admin image URLs keep their existing behavior.
• Deferred: the addExtImage raw block (the only remaining <script> in media.php) needs the same treatment but ships separately to keep this slice reviewable.

Verification

• php -l on both files.
• The emitted JS is byte-identical to the previous output (same esc_js() values, same
  statement order; only the surrounding <script> wrapper newlines differ).
• Rendered-markup diff on a live admin page will be attached from the PR test run.

Next steps

With this in place, the script-loader can attach a per-request nonce via the
wp_inline_script_attributes filter, enabling the report-only CSP discussed in Trac #59446.

Trac ticket: https://core.trac.wordpress.org/ticket/59446 (see comment 19).

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @tinhien11.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

Core Committers: Use this line as a base for the props when committing in SVN:

Props sergeybiryukov, westonruter.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[westonruter]

Let's use a nowdoc here too. The benefit here is IDEs will do syntax highlighting and syntax checking.

Before:

After:

Suggested change

	"document.body.className = document.body.className.replace('no-js','js');"
	<<<'JS'
	document.body.className = document.body.className.replace( 'no-js', 'js' );
	JS

[tinhien11]

Thanks for the detailed review @westonruter — all points addressed in cfaa362:

• Nowdoc everywhere: the admin-header no-js replacement script, the three preloaded handlers in media.php, and the popup addLoadEvent.
• media-upload-popup globals block now mirrors admin-header: unminified, strict-mode-compatible addLoadEvent, and Object.assign( window, wp_json_encode( ... ) ) with JSON_HEX_TAG | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_LINE_TERMINATORS. The popup keeps its original variable subset (ajaxurl, pagenow, adminpage, isRtl).
• media_send_to_editor() uses the suggested sprintf() + wp_json_encode() form.
• PHP close/reopen pairs removed: the wp_print_inline_script_tag() calls now sit directly in the surrounding PHP blocks in media_send_to_editor(), wp_iframe() (×2), media_upload_form_handler(), media_upload_gallery_form(), and both spots in admin-header.php.
• isRtl stays (int) as in your suggestion, preserving the previous JS value type.

Coding standards (PHP/JS) and PHP compatibility pass on the new head; the rest of the matrix is running.