Core Rule Set: Mastodon's ordinary requests pass by default (closes #238)

Adds mastodon.conf, the twelfth change. On Mastodon's paths, the fields
that carry a search, a name, a title, an address or free text skip the four
rules that read them as commands or system files. These cover the API, the
admin and settings pages, sign-in, and the objects other servers deliver to
an inbox. A post's text skips 932125, 932230 and 932235 too. Uploaded file
names skip 932180, and an ActivityPub Accept header skips 920600 on account
paths. Only Mastodon's own resources under /api/v1/ and /admin/ count, since
gitea and Drupal serve those prefixes. The requests recorded from Mastodon
4.7.5 pass at the defaults and while bodies are read.

Model: opus-5-5

internal/coreruleset/coreruleset.go

@@ -1,6 +1,6 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the eleven changes sww
+// body while SWW_WAF_BODY_LIMIT is set, with the twelve changes sww
 // makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
@@ -34,7 +34,8 @@ import (
 // paranoia level for %d, bodyDirectives for the first %s while
 // SWW_WAF_BODY_LIMIT is set, the exclusions file for the second,
 // giteaExclusions for the third, wordpressExclusions for the fourth,
-// drupalExclusions for the fifth, and mediawikiExclusions for the sixth.
+// drupalExclusions for the fifth, mediawikiExclusions for the sixth, and
+// mastodonExclusions for the seventh.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
@@ -91,7 +92,10 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
 # So does the tenth.
 %s
 
-# And the eleventh.
+# So does the eleventh.
+%s
+
+# And the twelfth.
 %s
 
 # The sixth: only the rules for requests are loaded, and no response is
@@ -206,6 +210,13 @@ var drupalExclusions string
 //go:embed mediawiki.conf
 var mediawikiExclusions string
 
+// mastodonExclusions are the twelfth change: the fields of Mastodon's own
+// requests that skip the rules that refused them there, as Coraza
+// directives.
+//
+//go:embed mastodon.conf
+var mastodonExclusions string
+
 // cookiesNotRead are the cookies the Core Rule Set reads a request
 // without, the rest of the fifth change.
 //
@@ -319,7 +330,7 @@ type CoreRuleSet struct {
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the eleven changes, at params'
+// New returns the Core Rule Set with the twelve changes, at params'
 // paranoia level, without the rules it switches off, reading request
 // bodies up to params' limit, and with params' exclusions file loaded
 // before the Core Rule Set's rules. An exclusions file is an error if it
@@ -348,7 +359,7 @@ func New(params Params) (*CoreRuleSet, error) {
 
 	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
 		giteaExclusions, wordpressExclusions, drupalExclusions,
-		mediawikiExclusions)
+		mediawikiExclusions, mastodonExclusions)
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))