Core Rule Set: Forgejo's ordinary requests pass by default (closes #342)

Forgejo 17.0.1's recorded requests are in
testdata/forgejo-requests.txt, checked at the defaults.

What Forgejo sends and gitea does not:
- its flash cookie is named flash, which joins gitea_flash among the
  cookies left out;
- its wiki search, whose q skips five rules in forgejo.conf, the
  fifteenth change.

Gaps in gitea's fixes the recording showed: q on the name searches
skips 932250 (ls -la), and the API's package search is one of them.
User and organisation pages, any one-segment path, keep 932250.

Model: opus-5-5

internal/coreruleset/recorded_test.go

@@ -149,6 +149,25 @@ func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 	wantRecordedRequestsPass(t, "drupal-requests.txt")
 }
 
+// TestOrdinaryForgejoRequestsPass checks Forgejo's recorded requests at the
+// defaults only. While bodies are read, the Core Rule Set still refuses the
+// file and branch names some of them carry in a form or JSON body, as it does
+// gitea's (TestGiteaBodiesTheCoreRuleSetRefuses).
+func TestOrdinaryForgejoRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := atDefaults(t)
+
+	for _, recorded := range recordedRequests(t, "forgejo-requests.txt") {
+		r := request{recorded.Method, recorded.Target, recorded.Headers}
+		if got, _ := inspectBody(t, crs, r, recorded.Body); got.Score >= threshold {
+			t.Errorf("%s %s refused: %+v", r.method, r.target, got)
+		}
+	}
+}
+
 func TestOrdinaryMastodonRequestsPass(t *testing.T) {
 	t.Parallel()