Do not keep answers for fields hidden by logic

[juanlentino]

Fixes #67.

Validation already skips a field that logic hides, but the field's posted value was still stored, and confirmation, notification and action rules read the stored values. This empties a hidden field's value after spam screening and before the entry is stored and the rules run. That is what the alltfo_visible_fields() docblock already says happens.

What changes

• includes/submission.php: alltfo_drop_hidden_values( $schema, $values ) runs right after alltfo_screen_for_spam().
  • For each input field hidden under the submitted values, it sets the value to alltfo_sanitize_field_value( '', $field ), the same shape as an unanswered field.
  • A hidden file field's uploads are deleted, the same way a refused submission's are.
• Spam screening still receives the posted values, so alltfo_spam_verdict callbacks are unaffected.
• No new hook, setting or UI. PHP only, so the assets/js bundles are untouched.

Tests (tests/phpunit/tests/hiddenValues.php)

• A value posted for a hidden field is stored empty, and a confirmation rule on that field does not fire.
• The same field, shown by its condition, keeps its answer and its rule fires.
• A hidden type field with no logic keeps its value.
• An alltfo_spam_verdict callback still sees the posted value.
• The submit-form ability gets the same result.

Tests ran in CI here: PHPUnit 806 tests, all passing (801 on main, plus these 5). I could not run them locally (no Docker on this machine). phpcs passes on the changed files. A no-JS browser is not exercised in a test; the request it sends is what the first test posts.

Possible behavior change for sites: a site that relied on a hidden field's value being stored (for example a pre-filled field behind logic) would see it empty. A field with no logic, including the hidden type, is unaffected.

The readme changelog is left to you, as on earlier contributor PRs.

Engineered with Claude as a pair programmer.