Escape properly the provided array of post codes

The callers only run wc_clean/esc_attr on the provided values which are
not functions meant to protect against SQL injections.

includes/class-wc-tax.php

@@ -262,6 +262,7 @@ class WC_Tax {
 	private static function get_matched_tax_rates( $country, $state, $postcode, $city, $tax_class, $valid_postcodes ) {
 		global $wpdb;
 
+		$valid_postcodes = array_map( 'esc_sql', $valid_postcodes );
 		$found_rates = $wpdb->get_results(
 			$wpdb->prepare( "
 				SELECT tax_rates.*