Core Rule Set: Mastodon's email field passes ordinary addresses (closes #273)

user[email] on /auth and the paths under it skips 930120, 932120 and
932260. They refused signing up, signing in and resetting a password
with addresses such as python3@example.com, powershell@example.com and
jane.profile@example.com. The field keeps 932250 and every other rule.

Recorded from Mastodon 4.7.5: sign-up, sign-in, password reset and an
email change.

Model: opus-5-5

internal/coreruleset/mastodon.conf

@@ -202,3 +202,17 @@ SecRule REQUEST_FILENAME "@streq /auth" \
     SecRule &ARGS_GET:/^user\[account_attributes\]\[username\]$/ "@eq 0" \
         "ctl:ruleRemoveTargetById=932120;ARGS:/^user\[account_attributes\]\[username\]$/,\
         ctl:ruleRemoveTargetById=932260;ARGS:/^user\[account_attributes\]\[username\]$/"
+
+# The sign-up, sign-in, password reset and account settings forms send an
+# email address in user[email]. It skips 930120, 932120 and 932260, which
+# refused these addresses:
+#   930120: jane.profile@example.com
+#   932120: powershell@example.com
+#   932260: python3@example.com
+# An address holds no spaces, so it keeps 932250, which needs ls -la.
+SecRule REQUEST_FILENAME "@rx ^/auth(?:/|$)" \
+    "id:900964,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^user\[email\]$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:/^user\[email\]$/,\
+        ctl:ruleRemoveTargetById=932120;ARGS:/^user\[email\]$/,\
+        ctl:ruleRemoveTargetById=932260;ARGS:/^user\[email\]$/"