Core Rule Set: Mastodon's ordinary requests pass by default (closes #238)

Adds mastodon.conf, the twelfth change. On Mastodon's paths, the fields
that carry a search, a name, a title, an address or free text skip the four
rules that read them as commands or system files. These cover the API, the
admin and settings pages, sign-in, and the objects other servers deliver to
an inbox. A post's text skips 932125, 932230 and 932235 too. Uploaded file
names skip 932180, and an ActivityPub Accept header skips 920600 on account
paths. Only Mastodon's own resources under /api/v1/ and /admin/ count, since
gitea and Drupal serve those prefixes. The requests recorded from Mastodon
4.7.5 pass at the defaults and while bodies are read.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -202,7 +202,7 @@ func atDefaults(t *testing.T) *coreruleset.CoreRuleSet {
 }
 
 // wantChange checks that crs lets through passes, a request one of the
-// eleven changes is for, and still finds result in refused, a request like
+// twelve changes is for, and still finds result in refused, a request like
 // it that the change is not for.
 func wantChange(
 	t *testing.T, crs *coreruleset.CoreRuleSet, passes, refused request,