Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237)

Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields
that carry a search, a title, a name, a file name or an address skip the
four rules that read them as commands or system files, and the wikitext
fields skip the rules that refused saving a page. /index.php counts as
MediaWiki's only with a title in its query, since WordPress serves it too.
The recorded requests from MediaWiki 1.46.2 pass at the defaults and while
bodies are read. The app tests share the check of recorded requests and the
list of hard values.

Model: opus-5-5

README.md

@@ -581,19 +581,22 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in ten ways so that ordinary requests
-  get through to a code forge, to WordPress and to Drupal. They include git over
-  HTTP and sign-in through Git Credential Manager on a code forge, and saving a
-  post from the block editor on WordPress. On gitea's own paths, its searches,
-  file names and branch names get through too. On WordPress's own paths, its
-  searches and file names do. On Drupal's own paths, the page to return to, its
-  searches and its names get through too. No setting undoes the changes; "Attack
-  detection" in [`SPEC.md`](SPEC.md) lists them.
+- `smallwebwaf` changes the Core Rule Set in eleven ways so that ordinary
+  requests get through to a code forge, to WordPress, to Drupal and to
+  MediaWiki. They include git over HTTP and sign-in through Git Credential
+  Manager on a code forge, and saving a post from the block editor on WordPress.
+  On gitea's own paths, its searches, file names and branch names get through
+  too. On WordPress's own paths, its searches and file names do. On Drupal's own
+  paths, the page to return to, its searches and its names get through too. On
+  MediaWiki's own paths, its searches, page titles, names and wikitext do. No
+  setting undoes the changes; "Attack detection" in [`SPEC.md`](SPEC.md) lists
+  them.
 - These apps work out of the box at the default settings, and their recorded
   ordinary requests pass the Core Rule Set:
     - gitea;
     - WordPress;
-    - Drupal.
+    - Drupal;
+    - MediaWiki.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again