[3.0] End the search for an avatar at the last resort

[albertlast]

Note

This change was produced by an LLM. The fix, the test, the commit message and
this description were all written by Claude (Anthropic), driven by @albertlast. It
has not yet had human code review.

Description

Avatar::__construct() looks for the member's image by trying each possibility in
turn, inside while (!$url->isValid()). The last possibility, reached when nothing
else produced anything, is a 1×1 transparent GIF as a data URI — there so that there
is always an answer:

// Last ditch fallback is a transparent 1x1 GIF.
default:
	$url = new Url('data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7');
	break;

Url::isValid() is filter_var($url, FILTER_VALIDATE_URL), which rejects a data
URI. So that answer never satisfies the condition the loop is testing, the switch
falls to default again on the next turn, and the loop never ends. The constructor
does not return, and the PHP worker running it spins until something kills it.

Reaching the last resort takes nothing exotic. The step before it is:

case 5:
	if (
		!empty(Config::$modSettings['avatar_url'])
		&& is_file(Config::$boarddir . '/avatars/default.png')
	) {

so a forum where avatar_url was never written — or one whose avatars/default.png
is not there — hangs on any member who has an avatar at all. Every page that shows
that member takes a worker with it.

The change is break 2 in place of break: at that point there is nothing further
to try, which is what the case is for.

Reproducing it

Without a forum, on release-3.0 as it stands:

require 'tests/bootstrap.php';

SMF\Config::$boardurl = 'https://example.com';
SMF\Config::$modSettings['gravatarEnabled'] = false;

new SMF\Avatar(url: 'Oxygen/beagle.png', id_member: 1);   // never returns

tests/Unit/AvatarFallbackTest.php is that, as a test. Against the unfixed
constructor it does not fail so much as never finish — phpunit --filter AvatarFallbackTest had to be killed at 40 seconds, having printed nothing past its
header. With the fix, both tests pass and the whole suite is back under a second.

The second test is the control: given an avatar_url, the same avatar is found the
ordinary way and the loop ends where it always did.

Notes for review

• id_member is passed to the constructor because that is the one argument that
  keeps it away from the attachments table, which is what makes this reachable from
  the unit suite at all.
• The test file is its own rather than joining an AvatarTest.php, because [3.0][Testing] Cover four more merged fixes in the unit suite #9586 and
  [3.0] Look for a gallery avatar where the gallery is #9588 each add an Avatar test file of their own and I would rather they merge in
  any order than have three PRs conflict on one file.

Issues References (Fixes|Related|Closes)

Related to #9586, #9588.