Core Rule Set: gitea's search Referer exclusion skips /api/v2/search (closes #270)

Rule 900601 let Referer skip five rules when it named a repository's
search, issues or pull requests with the owner api, such as
/api/v2/search, Mastodon's search. A page opened from there skipped
script and SQL injection checks on Referer. gitea has no owner named
api, so a chained condition now leaves out those paths, as rule 900600
does.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -692,6 +692,17 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 				t.Errorf("%s let through: %+v", target, got)
 			}
 		}
+
+		// Nor is a page opened from them.
+		for _, attack := range []string{
+			"<script>alert(1)</script>",
+			"1' OR '1'='1",
+		} {
+			referer := "Referer: https://example.com" + path + "?q=" + attack
+			if got := inspect(t, crs, get("/", referer)); got.Score < threshold {
+				t.Errorf("%s let through: %+v", referer, got)
+			}
+		}
 	}
 }