Core Rule Set: Mastodon's email field passes ordinary addresses (closes #273)

user[email] on /auth and the paths under it skips 930120, 932120 and
932260. They refused signing up, signing in and resetting a password
with addresses such as python3@example.com, powershell@example.com and
jane.profile@example.com. The field keeps 932250 and every other rule.

Recorded from Mastodon 4.7.5: sign-up, sign-in, password reset and an
email change.

Model: opus-5-5

README.md

@@ -589,8 +589,9 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   searches, names and file names do. On Drupal's own paths, the page to return
   to, its searches and its names get through too. On MediaWiki's own paths, its
   searches, page titles, names and wikitext do. On Mastodon's own paths, its
-  searches, names, posts and deliveries from other servers do. No setting undoes
-  the changes; "Attack detection" in [`SPEC.md`](SPEC.md) lists them.
+  searches, names, email addresses, posts and deliveries from other servers do.
+  No setting undoes the changes; "Attack detection" in [`SPEC.md`](SPEC.md)
+  lists them.
 - These apps work out of the box at the default settings, and their recorded
   ordinary requests pass the Core Rule Set:
     - gitea;