Core Rule Set tests: WordPress's recorded requests go through the shared check (closes #284)

WordPress's recorded requests now go through wantRecordedRequestsPass,
so a request with no body but a Content-Type is also inspected while
bodies are read, as every other app's is. The seven such requests,
wp-cron.php's, pass; wordpress.conf is unchanged.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -841,28 +841,10 @@ func TestOrdinaryWordPressRequestsPassAndAttacksAreRefused(t *testing.T) {
 
 	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
 
+	wantRecordedRequestsPass(t, "wordpress-requests.txt")
+
 	defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t)
 
-	for _, recorded := range recordedRequests(t, "wordpress-requests.txt") {
-		t.Run(recorded.Method+" "+recorded.Target, func(t *testing.T) {
-			t.Parallel()
-
-			r := request{recorded.Method, recorded.Target, recorded.Headers}
-
-			crsSets := []*coreruleset.CoreRuleSet{defaults}
-			if recorded.Body != "" {
-				crsSets = append(crsSets, bodies)
-			}
-
-			for _, crs := range crsSets {
-				got, _ := inspectBody(t, crs, r, recorded.Body)
-				if got.Score >= threshold {
-					t.Errorf("%s %s %.200q refused: %+v", r.method, r.target, recorded.Body, got)
-				}
-			}
-		})
-	}
-
 	for _, attack := range []string{
 		sqlInjection,
 		"..%2F..%2Fwp-config.php",