Using `$wp` doesn't work in certain scenarios, where the entire system
didn't complete bootstrapping.
The raw query, after escaping the values, should sufficiently cater for
the need.
Some sites don't have permalinks enabled (e.g. local dev environments) and
can't use the WC site API functionality.
The `rest_get_url_prefix` elsewhere is only used in permalink context (e.g.
`get_rest_url` uses it conditionally), while `$wp->query_vars` are always
populated, even in rewrite condition, thus making them more accessible.
This to support scenario in which HTTP_AUTHORIZATION being stripped
and use getallheaders as a fallback. This helper method is copied from
class-wc-rest-authentication.php.
Claudio Sanches
Justas Butkus
Rommel Castro
Akeda Bagus