Core Rule Set: Ghost's ordinary requests pass by default (closes #357)

Ghost 6.76.0's ordinary traffic, recorded in `testdata/ghost-requests.txt`,
passes at the default settings and while bodies are read. It covers public
pages, members' sign-up and sign-in, the admin, the editor saving and
publishing posts and pages with code blocks and HTML cards, tags, settings,
staff invitations, uploads, newsletter settings, and both APIs. The new
`ghost.conf`, the sixteenth change, lets through `filter`, the member
`search` and the embed `url` in the query, and plain text, addresses,
articles, code injection and passwords in JSON bodies. A `<script>` element
and a `javascript:` link stay refused in articles and code injection.
`README.md` lists Ghost; `SPEC.md` lists the change.

Model: opus-5-5

internal/coreruleset/recorded_test.go

@@ -168,6 +168,12 @@ func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	}
 }
 
+func TestOrdinaryGhostRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "ghost-requests.txt")
+}
+
 func TestOrdinaryMastodonRequestsPass(t *testing.T) {
 	t.Parallel()