Refactor security policies and disable block editor notes

[dannorthern]

This pull request enhances the way comment-related features are disabled, especially focusing on block editor notes and REST API requests, and improves the login error handling logic. The most important changes are grouped below:

Comment and Editor Notes Disabling Improvements:

• Added logic to strip block editor notes from post type registration arguments and to remove editor notes support from post types, preventing the block editor from making /wp/v2/comments?type=note REST API requests when comments are disabled. This addresses issues with the collaboration sidebar and ensures no REST conflicts. (inc/Comments/Actions.php, README.md) [1] [2] [3] [4]
• Updated the initialization flow to ensure comment and editor notes disabling logic runs late enough to catch all post types, including those registered after priority 0. (inc/Comments/Actions.php)

Login Error Handling Improvements:

• Improved the logic for preventing username-based logins: now core is allowed to handle empty credentials, and only non-email usernames are blocked with a clear error message. (inc/Security/Login.php)
• Updated the generic login error method to only override errors when there is an actual error message, preventing unnecessary overrides. (inc/Security/Login.php)