Core Rule Set: Ghost's ordinary requests pass by default (closes #357)

Ghost 6.76.0's ordinary traffic, recorded in `testdata/ghost-requests.txt`,
passes at the default settings and while bodies are read. It covers public
pages, members' sign-up and sign-in, the admin, the editor saving and
publishing posts and pages with code blocks and HTML cards, tags, settings,
staff invitations, uploads, newsletter settings, and both APIs. Ghost's
fixes, in the new `ghost.conf`, let through `filter`, the member `search`
and the embed `url` in the query, and plain text, addresses, articles, code
injection and passwords in JSON bodies. A `<script>` element and a
`javascript:` link stay refused in articles and code injection. `SWW_APPS`
names Ghost `ghost`. `README.md` lists Ghost; `SPEC.md` lists its fixes.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -1310,7 +1310,8 @@ func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
 	// These fields skip the rules only when the query has no field of the
 	// same name. An SQL injection in the query is refused. MediaWiki's
 	// password and retype skip them only when authAction names their form,
-	// so its rows send that before the field.
+	// so its rows send that before the field. Ghost's rows name each field
+	// as Coraza names a field of a JSON body.
 	for _, sent := range []struct{ path, field string }{
 		{nextcloudSignIn, passwordField},
 		{mediawikiAPI, passwordField},
@@ -1333,6 +1334,14 @@ func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
 		{"/settings/personal/changepassword", "newpassword="},
 		{"/apps/encryption/ajax/adminRecovery", "confirmPassword="},
 		{"/admin", "token="},
+		{ghostSession, "json.password="},
+		{"/ghost/api/admin/authentication/setup/", "json.setup.0.password="},
+		{"/ghost/api/admin/authentication/invitation/", "json.invitation.0.password="},
+		{
+			"/ghost/api/admin/authentication/password_reset/",
+			"json.password_reset.0.newPassword=",
+		},
+		{"/ghost/api/admin/users/password/", "json.password.0.oldPassword="},
 	} {
 		r := request{
 			http.MethodPost, sent.path + "?" + sent.field + "'%20OR%20'1'='1",