script/gitea-requests, and the gitea refusals it confirms named in SPEC.md (closes #30)

script/gitea-requests runs gitea 1.27.3 behind the image at its
defaults, sends through it the requests that reading gitea's source
found the Core Rule Set refuses, with a short sample of ordinary use,
and prints each request with the rule ids that matched it. make
gitea-requests runs it; make check does not.

Every case still holds, and each fix would let through what SPEC.md
says stays refused, so the notes specific to gitea now name them with
how each refusal plays out: file names in query parameters that read as
Java, script, PowerShell or SQL, such paths, and an image push that
reuses a layer of an image named like a command.

Model: opus-5-5

README.md

@@ -2374,6 +2374,19 @@ so that they run in minimal containers.
   the same volume still refuses the banned client; then removes the containers,
   the volume and both images. It needs network access, for nixpkgs' binary
   cache, and `script/check` does not run it; `make example-app` does.
+- `script/gitea-requests`: builds the image and runs gitea 1.27.3 behind it,
+  with every setting of `smallwebwaf` at its default but `SWWAF_UPSTREAM_URL`,
+  which names gitea's container. It sends through it the gitea requests that the
+  notes specific to gitea in [`SPEC.md`](SPEC.md) name for a file name in a
+  query parameter, for a path and for a container image push, and a short sample
+  of gitea's ordinary use: signing in, pages of files and commits, a diff, the
+  API, a push, clone and fetch over HTTP, and two container image pushes. It
+  prints a line for each request `smallwebwaf` logged, with what it did with it
+  and the ids of the Core Rule Set's rules that matched it, then removes the
+  containers, the network and the images it made, but gitea's own image. It
+  needs network access, and a docker daemon that pushes to a registry on
+  `localhost` over plain HTTP, as docker does by default; `script/check` does
+  not run it, and `make gitea-requests` does.
 
 ## TODO