Add test coverage for CONTRIB-2014-015

most likely is still relevant

Added tests to cover the scenarios mentioned in the description.
Test is green now.

Based on the summary seems like a good test coverage being added.

NW for some code style things.

This isn't an issue where the test-only pipeline helps us, since core itself does not expose the vulnerability and there's no commit to revert. Looking at the original SA:
https://www.drupal.org/forum/newsletters/security-advisories-for-contrib... →

That's an SA for CCK in Drupal 6. 😅 The field system before it was in core! So this issue's history is to prove core doesn't have the vulnerability CCK did.

So, in this case, it's just additional test coverage proving core works, and doesn't need additional review beyond verifying that the test provides the expected coverage and makes sense internally.

Saving credits.