Always consider casting sanitization

There are two different sanitization checks in the `VIP.ValidatedSanitizedInput` sniff. Only one of
them was considering that casting is a form of input sanitization. I’ve
moved the casting check out of the conditional it was in, and now the
`$is_casted` value is being checked for all sanitization checking paths.

Includes unit tests.

Fixes #179