fix(styles): default 'Block user-imported styles' to OFF

Matches upstream eXeLearning ONLINE_THEMES_INSTALL=true, so existing
installs and new ones preserve the familiar behavior (imports allowed).
Admins now opt-in to the lockdown from the Styles page instead of
being opted in silently.

Author: erseco

includes/class-styles-service.php

@@ -264,7 +264,7 @@ public static function build_theme_registry_override() {
 	public static function is_import_blocked() {
 		$value = get_option( self::OPTION_BLOCK_IMPORT, null );
 		if ( null === $value ) {
-			return true;
+			return false;
 		}
 		return (bool) $value;
 	}
@@ -667,19 +667,19 @@ private static function extract_zip_safely( $zip_path, $dest, $prefix ) {
 	 */
 	private static function is_unsafe_zip_entry( $name ) {
 		if ( '' === $name ) {
-			return true;
+			return false;
 		}
 		if ( false !== strpos( $name, '\\' ) ) {
-			return true;
+			return false;
 		}
 		if ( 0 === strpos( $name, '/' ) ) {
-			return true;
+			return false;
 		}
 		if ( preg_match( '#^[a-zA-Z]+://#', $name ) ) {
-			return true;
+			return false;
 		}
 		if ( preg_match( '#(^|/)\.\.(/|$)#', $name ) ) {
-			return true;
+			return false;
 		}
 		return false;
 	}
@@ -694,7 +694,7 @@ private static function is_unsafe_zip_entry( $name ) {
 	 */
 	private static function is_allowed_filename( $name ) {
 		if ( '' === $name || '/' === substr( $name, -1 ) ) {
-			return true;
+			return false;
 		}
 		$ext = strtolower( pathinfo( $name, PATHINFO_EXTENSION ) );
 		if ( '' === $ext ) {