SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

Each app's fixes are one .conf file, whose first rule skips the rest
unless Inspect sets tx.app_<name>, and one entry in apps. SWW_APPS names
each hostname's apps. A hostname gets only its apps' fixes; while
SWW_APPS is unset, every hostname gets every app's fixes.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

internal/coreruleset/mediawiki_test.go

@@ -4,6 +4,8 @@ import (
 	"net/http"
 	"slices"
 	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
 // mediawikiThreshold is SWW_WAF_ANOMALY_THRESHOLD's default.
@@ -45,7 +47,35 @@ const (
 func TestOrdinaryMediaWikiRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	wantRecordedRequestsPass(t, "mediawiki-requests.txt")
+	wantRecordedRequestsPass(t, "mediawiki-requests.txt", atDefaults(t), readingBodies(t))
+}
+
+func TestMediaWikiFixesApplyOnlyToAHostnameThatServesMediaWiki(t *testing.T) {
+	t.Parallel()
+
+	crs := servingApps(t, map[string][]string{
+		giteaHost: {gitea}, otherHost: {"mediawiki"},
+	})
+
+	// A search, which only MediaWiki's fixes let through.
+	search := get("/index.php?title=Special:Search&search=python3")
+
+	wantResult(t, crs, withHost(search, otherHost), coreruleset.Result{})
+	wantResult(t, crs, withHost(search, giteaHost), matched(932260))
+}
+
+func TestHostnameListingMediaWikiLetsItsRecordedRequestsThrough(t *testing.T) {
+	t.Parallel()
+
+	// The requests were recorded on example.com.
+	apps := map[string][]string{"example.com": {"mediawiki"}}
+
+	bodies := shared(t, coreruleset.Params{
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		Apps: apps,
+	})
+
+	wantRecordedRequestsPass(t, "mediawiki-requests.txt", servingApps(t, apps), bodies)
 }
 
 // mediawikiQueryFields and mediawikiBodyFields together hold every field that