Core Rule Set: a repository's name passes in the adopt form's id (closes #365)

While bodies are read, the admin forms that adopt or delete an unadopted
repository were refused when the repository's name held a command or a
system file's name, such as alice/python3-app, alice/powershell-scripts or
alice/.profile. id there now skips 930120, 932120 and 932260, on gitea's
/-/admin/repos/unadopted and Forgejo's /admin/repos/unadopted.

Model: opus-5-5

internal/coreruleset/gitea.conf

@@ -1,8 +1,9 @@
 # The eighth change: on gitea's paths, some fields skip the rules that refused
 # ordinary gitea requests there. They are the fields where gitea sends a search,
-# a file name or a branch name. Each exclusion runs with the request, before the
-# rules it switches off, those of phase 1 included, so this file is loaded before
-# the Core Rule Set's rules. Each comment names a request the rule refused.
+# a file name, a branch name or a repository's name. Each exclusion runs with
+# the request, before the rules it switches off, those of phase 1 included, so
+# this file is loaded before the Core Rule Set's rules. Each comment names a
+# request the rule refused.
 
 # gitea's searches of code, of issues and pull requests, and of commits send the
 # text searched for in q, which skips these rules there:
@@ -322,6 +323,19 @@ SecRule REQUEST_FILENAME \
     "id:900640,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=920450;REQUEST_HEADERS_NAMES:Content-Range"
 
+# The admin forms that adopt or delete an unadopted repository send its owner
+# and name in id, as alice/python3-app. id skips these rules there:
+#   930120: alice/.profile
+#   932120: alice/powershell-scripts
+#   932260: alice/python3-app
+# gitea serves the forms at /-/admin/repos/unadopted and Forgejo at
+# /admin/repos/unadopted.
+SecRule REQUEST_FILENAME "@rx ^/(?:-/)?admin/repos/unadopted$" \
+    "id:900645,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:id,\
+    ctl:ruleRemoveTargetById=932120;ARGS:id,\
+    ctl:ruleRemoveTargetById=932260;ARGS:id"
+
 # The passwords skip each rule that random passwords set off:
 #   password: signing in, signing up, linking an account, activating an account,
 #   resetting or changing the password, deleting an account, and creating or