Core Rule Set tests: check the recorded requests without the race detector (closes #290)

The tests that check the apps' recorded requests move to
internal/coreruleset/recorded_test.go, behind the recorded build tag. The
test phase runs them in a second go test, without -race.

The Gitea and WordPress tests are split in two. Their recorded-request loops
become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass;
their attack checks stay in the race pass as TestGiteaAttacksAreRefused and
TestWordPressAttacksAreRefused.

Model: opus-5-5

Dockerfile

@@ -43,6 +43,12 @@ RUN --mount=type=tmpfs,target=/root/.cache/go-build \
     { echo "--- Rerunning with -v for details ---"; \
       go test -tags no_fs_access -timeout 90s -race -v ./...; exit 1; }
 
+# Second pass: the recorded requests, too slow for make test under -race.
+RUN --mount=type=tmpfs,target=/root/.cache/go-build \
+    go test -tags no_fs_access,recorded -timeout 90s -cover ./internal/coreruleset/... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -tags no_fs_access,recorded -timeout 90s -v ./internal/coreruleset/...; exit 1; }
+
 # Tidy stage: `go mod tidy` in the test phase's Go, so that the files it
 # writes pass the test phase's check. Nothing else depends on it, so only
 # script/tidy, which names the stage after it, builds it.