Core Rule Set: WordPress's ordinary requests pass by default (closes #235)

Add the ninth change: wordpress.conf switches off, per path and field, each
rule that refused ordinary WordPress 7.1.4 requests. Three groups of query
fields skip the five rules on system files and commands. Add the recorded
requests, a test at the defaults and reading bodies, and list WordPress in the
README.

Model: opus-5-5 (rework); sonnet-5-5 (copied the recorded lines)

README.md

@@ -581,11 +581,17 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in eight ways so that it lets ordinary
-  requests to a code forge through, such as git over HTTP and sign-in through
-  Git Credential Manager. On gitea's own paths, its searches, file names and
-  branch names get through too. No setting undoes the changes; "Attack
-  detection" in [`SPEC.md`](SPEC.md) lists them.
+- `smallwebwaf` changes the Core Rule Set in nine ways so that ordinary requests
+  get through to a code forge and to WordPress. They include git over HTTP and
+  sign-in through Git Credential Manager on a code forge, and saving a post from
+  the block editor on WordPress. On gitea's own paths, its searches, file names
+  and branch names get through too. On WordPress's own paths, its searches and
+  file names do. No setting undoes the changes; "Attack detection" in
+  [`SPEC.md`](SPEC.md) lists them.
+- These apps work out of the box at the default settings, and their recorded
+  ordinary requests pass the Core Rule Set:
+    - gitea;
+    - WordPress.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again