fix(migration): prevent duplicate actor fields

[faisalahammad]

Fixes #3339

Proposed changes:

• Prevent the "Powered by WordPress" extra field from being added more than once per actor. The migration seeder now skips insertion when a field with the same title already exists.
• Add a migration step that runs once on upgrade and removes duplicate "Powered by" fields for the blog actor and every ActivityPub-capable user, keeping the oldest one.
• The cleanup runs only when moving to the unreleased version, so fresh installs are unaffected and existing duplicates collapse to a single field.

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• Install the plugin on a site that already has several duplicate "Powered by" fields in Settings → ActivityPub.
• Run the upgrade (activate the updated plugin).
• Confirm the field appears only once for the blog actor and for each user.
• On a fresh install, confirm exactly one "Powered by" field is created per actor.
• Delete the field manually, then run migrations again and confirm it is not re-added.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

Fixed the "Powered by WordPress" profile field being added multiple times, and cleaned up any existing duplicates on update.

[pfefferle]

Thanks a lot @faisalahammad, and sorry for the long back and forth here.

I went a different way in #3666, so I am superseding this one.

Digging into it, the duplication and the "field comes back after I delete it" reports turned out to be the same missing piece. Extra_Fields::default_actor_extra_fields() writes an activitypub_default_extra_fields flag when it provisions defaults and checks it before provisioning again, but Migration::add_default_extra_field() never wrote that flag. Claiming the actor with it before inserting stops the duplicate, and it also makes a deleted field stay deleted, which a lookup by title cannot do.

That also let me drop the cleanup migration. Matching duplicates by title means force deleting user editable content on init, and I would rather not risk that for a field people can remove in the settings.

Your tests and testing instructions were useful for working out what the actual behaviour is, so this was not wasted. Sorry again that it ended up somewhere else.