Refreshing meta box nonce after re-authenticating following a wp_auth_check()

[hrkhal]

Fixes #669

Filters wp_refresh_nonces to refresh the coauthors-edit nonce to prevent data loss after re-authenticating an expired session.

[rebeccahum]

Thanks for the PR -- can we get some steps on how to reproduce the issue?

[hrkhal]

@rebeccahum To reproduce the issue you'll need an install with custom fields and meta boxes in the post editor and just the co-authors-plus plugin activated. Then:

1. Open up the post edtior and add some content and fill in custom meta Save as normal.
2. Open up wp-admin in a new tab and log out of wp-admin from it.
3. Return to post editor tab and wait for the auth check modal and then reauthenticate by logging in
4. Update the content and edit the custom meta.
5. Now attempt to save the post and you'll hit the Link has expired screen instead of successful post save.
6. Follow the please try again link and you’ll notice that post content has likely saved (due to autosave) but all the custom meta changes have been lost.

We get the Link has expired die screen because the check_admin_referrer check in co-authors-plus fails due to the expired nonce that wasn’t refreshed after re-authenticating. Thus any save_post actions after never fired and thus data lost.

By implementing this PR the main co-authors nonce is refreshed after re-authenticating which will prevent the data loss described above.

You may also notice that at step 4, you’ll be unable to search for new authors to add via the co-authors-plus meta box. This is because the nonce stored in the JS var coAuthorsPlus_ajax_suggest_link is also now invalid because of the re-authenticating. Due to the way it's stored wp_refresh_nonces doesn't fix it. This is a seperate issue I'll likely open an issue/pr for.

[GaryJones]

✅ Wonderful recreation instructions @hrkhal - much appreciated!

With the Classic Editor plugin active in WP 6.2.2, I was able to recreate this (though after "Please try again" the post meta did seem to be saved); the patch worked to remove the Link has expired die screen.

With the block editor in WP 6.2.2, this doesn't seem to be an issue. With other plugins activated, I got an "Updating failed" while following the procedure, but this persisted with the PR applied as well. On master and with this patch, after logging back in and editing content and post meta, the save worked correctly.