Core Rule Set: the package registries' searches of gitea and Forgejo pass (closes #354)

Recorded from gitea 1.27.3 and Forgejo 17.0.1 with each registry's own
client, and curl for the Chef cookbook list and NuGet's Packages(), with
python3, powershell, ls -la, .htaccess, file names and plain words. q on
the Cargo, Chef, Composer and Conan searches and NuGet's search service
joins 900603. 900605 lets /bin/sh through on Composer and Conan. New:
900609 for npm's text, 900611 lets a Conan pattern such as zlib/* skip
942100, and 900612 for NuGet's Search() and Packages(): searchTerm,
$filter, and the names $filter, $orderby and $top for 942290.

Model: opus-5-5

SPEC.md

@@ -888,7 +888,8 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
         - a repository's branches, tags and packages pages;
         - an owner's packages page;
         - the admin page of packages;
-        - the API's search of packages.
+        - the API's search of packages;
+        - the searches of the Composer and Conan registries.
 
     - `q` on gitea's other searches, for the same four rules. Words such as
       `python3`, `powershell`, `ls -la` and `.htaccess` were refused there. The
@@ -905,7 +906,9 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
         - the admin lists of users, organisations, repositories, unadopted
           repositories and emails;
         - the API's searches of topics, of an organisation's teams and of
-          emails.
+          emails;
+        - the searches of the Cargo, Chef, Composer and Conan registries, and
+          the NuGet registry's search service.
 
         Most send `q` in the query string. The admin forms that adopt a
         repository or activate an email send it in the body. gitea serves its
@@ -916,6 +919,22 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
           and a name, such as `alice/python3-app`;
         - `name` of the search of a repository's milestones.
 
+    - Fields of the package registries' searches:
+        - `text` of the npm registry's search, for the same four rules and the
+          rule for shell paths (932160). An npm name can hold a slash, as
+          `@alice/tools-cli` does.
+        - `searchTerm` of the NuGet registry's searches `Search()` and
+          `Packages()`, for the same four rules.
+        - `$filter` of those two searches, for the lists of system files and
+          Windows commands (930120, 932120). It holds an expression such as
+          `tolower(Id) eq 'python3'`.
+        - The names `$filter`, `$orderby` and `$top` on those two searches, for
+          the rule for MongoDB operators (942290). It refused every such search.
+        - `q` of a Conan search, for the rule for SQL injection (942100), which
+          refused the pattern `zlib/*`. `q` skips it only when the query string
+          has one `q`, made only of letters, digits, `_`, `.`, `+`, `-`, `/`,
+          `@` and `*`.
+
     - The path of these requests, which names a file:
         - a file's page;
         - its raw file;