Stored XSS via the data-wp-bind directive in block patterns

WordPress is vulnerable to stored XSS via the data-wp-bind directive due to insufficient validation in block pattern file inclusion and template element lookups. The fix hardens the block pattern registry with path validation and restricts wp.template to match only