Core Rule Set: gitea's ordinary requests pass by default (#208)

docs/settings.md

@@ -191,6 +191,15 @@ chooses between the two (see "The image's command" below).
   the Core Rule Set reads, a size of at most `64K`. A question carries no more
   of a body than 64 KiB, and the Core Rule Set reads at most 64 KiB less one
   byte of it, whatever the value (see "The answer" in [`SPEC.md`](../SPEC.md)).
+- `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE` (default unset): a file of Core Rule Set
+  exclusions, written as Coraza directives. It is loaded before the Core Rule
+  Set's rules, so it holds only `SecAction` and `SecRule` lines that exclude
+  with `ctl:ruleRemoveTargetById` or `ctl:ruleRemoveById`. A file that cannot be
+  read or does not parse stops the start, whatever `SWWAF_WAF_MODE` is. So does
+  a file that names a number from 900000 to 900999 outside a comment, alone or
+  in a range. So does a directive that removes or changes rules as the file
+  loads, such as `SecRuleRemoveById`, since none of the Core Rule Set's rules is
+  loaded yet. It has no `_FILE` form.
 - `SWWAF_ERROR_BURST_THRESHOLD` (default `30`): the most refusals of one client
   in a minute (see "Attack detection" in `SPEC.md`). A count or `off`.