Core Rule Set: Mastodon's ordinary requests pass by default (closes #238)

Adds mastodon.conf, the twelfth change. On Mastodon's paths, the fields
that carry a search, a name, a title, an address, a password or free text
skip the four rules that read them as commands or system files. They cover
the API and the web app's JSON, the admin and settings pages, sign-up and
sign-in, and the objects other servers deliver to an inbox. A post's text
skips 932125, 932230 and 932235 too. Hashtags and sign-up usernames skip
only 932120 and 932260. Uploaded file names skip 932180, a report's
forward keys skip 930120 by name, and the Accept header of a link lookup
skips 920600 on profile and post links. The requests recorded from
Mastodon 4.7.5 pass at the defaults and while bodies are read.

Model: opus-5-5

README.md

@@ -581,22 +581,23 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in eleven ways so that ordinary
-  requests get through to a code forge, to WordPress, to Drupal and to
-  MediaWiki. They include git over HTTP and sign-in through Git Credential
-  Manager on a code forge, and saving a post from the block editor on WordPress.
-  On gitea's own paths, its searches, file names and branch names get through
-  too. On WordPress's own paths, its searches, names and file names do. On
-  Drupal's own paths, the page to return to, its searches and its names get
-  through too. On MediaWiki's own paths, its searches, page titles, names and
-  wikitext do. No setting undoes the changes; "Attack detection" in
-  [`SPEC.md`](SPEC.md) lists them.
+- `smallwebwaf` changes the Core Rule Set in twelve ways so that ordinary
+  requests get through to the apps listed below. These requests include git over
+  HTTP and sign-in through Git Credential Manager on a code forge, and saving a
+  post from the block editor on WordPress. On gitea's own paths, its searches,
+  file names and branch names get through too. On WordPress's own paths, its
+  searches, names and file names do. On Drupal's own paths, the page to return
+  to, its searches and its names get through too. On MediaWiki's own paths, its
+  searches, page titles, names and wikitext do. On Mastodon's own paths, its
+  searches, names, posts and deliveries from other servers do. No setting undoes
+  the changes; "Attack detection" in [`SPEC.md`](SPEC.md) lists them.
 - These apps work out of the box at the default settings, and their recorded
   ordinary requests pass the Core Rule Set:
     - gitea;
     - WordPress;
     - Drupal;
-    - MediaWiki.
+    - MediaWiki;
+    - Mastodon.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again