Core Rule Set: Vaultwarden's ordinary requests pass by default (closes #239)

Adds vaultwarden.conf, the thirteenth change, with rule ids 900150 to
900153. On Vaultwarden's account, organization and admin paths, names and
password hints skip 930120, 932120, 932250 and 932260, and so does a
security key's name. Email addresses skip 930120, 932120 and 932260
there, on the two-factor email paths and when signing in with another
device. So does the address of the admin page's test email. The data
breach report's address does too. The encrypted names of uploaded
attachments and file sends skip 920120. Requests recorded from
Vaultwarden 1.37.5 through the web vault, the Bitwarden command line
client and the admin page pass at the defaults and while bodies are read.

Model: opus-5-5

internal/coreruleset/coreruleset.go

@@ -1,6 +1,6 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the twelve changes sww
+// body while SWW_WAF_BODY_LIMIT is set, with the thirteen changes sww
 // makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
@@ -34,8 +34,9 @@ import (
 // paranoia level for %d, bodyDirectives for the first %s while
 // SWW_WAF_BODY_LIMIT is set, the exclusions file for the second,
 // giteaExclusions for the third, wordpressExclusions for the fourth,
-// drupalExclusions for the fifth, mediawikiExclusions for the sixth, and
-// mastodonExclusions for the seventh.
+// drupalExclusions for the fifth, mediawikiExclusions for the sixth,
+// mastodonExclusions for the seventh, and vaultwardenExclusions for the
+// eighth.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
@@ -95,7 +96,10 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
 # So does the eleventh.
 %s
 
-# And the twelfth.
+# So does the twelfth.
+%s
+
+# And the thirteenth.
 %s
 
 # The sixth: only the rules for requests are loaded, and no response is
@@ -217,6 +221,13 @@ var mediawikiExclusions string
 //go:embed mastodon.conf
 var mastodonExclusions string
 
+// vaultwardenExclusions are the thirteenth change: the fields of
+// Vaultwarden's own requests that skip the rules that refused them there, as
+// Coraza directives.
+//
+//go:embed vaultwarden.conf
+var vaultwardenExclusions string
+
 // cookiesNotRead are the cookies the Core Rule Set reads a request
 // without, the rest of the fifth change.
 //
@@ -330,7 +341,7 @@ type CoreRuleSet struct {
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the twelve changes, at params'
+// New returns the Core Rule Set with the thirteen changes, at params'
 // paranoia level, without the rules it switches off, reading request
 // bodies up to params' limit, and with params' exclusions file loaded
 // before the Core Rule Set's rules. An exclusions file is an error if it
@@ -359,7 +370,7 @@ func New(params Params) (*CoreRuleSet, error) {
 
 	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
 		giteaExclusions, wordpressExclusions, drupalExclusions,
-		mediawikiExclusions, mastodonExclusions)
+		mediawikiExclusions, mastodonExclusions, vaultwardenExclusions)
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))