SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

Each app's fixes are one .conf file, whose first rule skips the rest
unless Inspect sets tx.app_<name>, and one entry in apps. SWW_APPS names
each hostname's apps. A hostname gets only its apps' fixes; while
SWW_APPS is unset, every hostname gets every app's fixes.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

internal/coreruleset/drupal_test.go

@@ -5,6 +5,8 @@ import (
 	"net/url"
 	"slices"
 	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
 // drupalThreshold is SWW_WAF_ANOMALY_THRESHOLD's default.
@@ -34,7 +36,35 @@ const drupalName = "name="
 func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	wantRecordedRequestsPass(t, "drupal-requests.txt")
+	wantRecordedRequestsPass(t, "drupal-requests.txt", atDefaults(t), readingBodies(t))
+}
+
+func TestDrupalFixesApplyOnlyToAHostnameThatServesDrupal(t *testing.T) {
+	t.Parallel()
+
+	crs := servingApps(t, map[string][]string{
+		giteaHost: {gitea}, otherHost: {"drupal"},
+	})
+
+	// A search, which only Drupal's fixes let through.
+	search := get("/search?keys=python3")
+
+	wantResult(t, crs, withHost(search, otherHost), coreruleset.Result{})
+	wantResult(t, crs, withHost(search, giteaHost), matched(932260))
+}
+
+func TestHostnameListingDrupalLetsItsRecordedRequestsThrough(t *testing.T) {
+	t.Parallel()
+
+	// The requests were recorded on example.com.
+	apps := map[string][]string{"example.com": {"drupal"}}
+
+	bodies := shared(t, coreruleset.Params{
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		Apps: apps,
+	})
+
+	wantRecordedRequestsPass(t, "drupal-requests.txt", servingApps(t, apps), bodies)
 }
 
 // drupalAttacks are an SQL injection, a path traversal and a script