Core Rule Set: WordPress's ordinary requests pass by default (closes #235)

Add the ninth change: wordpress.conf switches off, per path and field, each
rule that refused ordinary WordPress 7.1.4 requests. Three groups of fields
skip four rules on system files and commands, and the fields that hold an
address also skip 932235. Add the recorded requests, a test at the defaults and
reading bodies, and list WordPress in the README.

Model: opus-5-5 (rework); sonnet-5-5 (copied the recorded lines)

SPEC.md

@@ -81,7 +81,7 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/coreruleset`: the Core Rule Set, with the eight changes listed
+    - `internal/coreruleset`: the Core Rule Set, with the nine changes listed
       under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
@@ -674,7 +674,8 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions; the eighth change below holds gitea's.
+  holds an app's own exclusions; the eighth and ninth changes below hold gitea's
+  and WordPress's.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
       `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
@@ -720,9 +721,9 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in eight ways, since in front of
-gitea it would otherwise refuse ordinary requests. The changes hold in front of
-every app, and no setting undoes them:
+`smallwebwaf` changes the Core Rule Set 4.25.0 in nine ways, since in front of
+gitea and WordPress it would otherwise refuse ordinary requests. The changes
+hold in front of every app, and no setting undoes them:
 
 1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
    and `OPTIONS`. APIs, container image pushes and package uploads use them.
@@ -753,9 +754,9 @@ every app, and no setting undoes them:
     catch reaches the app, such as the command `|cat /etc/passwd`. Path
     traversal, SQL and script injection, and PHP, Java and Node.js code are
     still refused there. Other parameters keep all three rules, except on the
-    gitea paths the eighth change names. An app that uses one of these
-    parameters as a file on the server, or passes it to a shell, must check the
-    value itself. A rule file can refuse it instead.
+    gitea and WordPress paths the eighth and ninth changes name. An app that
+    uses one of these parameters as a file on the server, or passes it to a
+    shell, must check the value itself. A rule file can refuse it instead.
 
 5. Two cookies are left out, and `Referer` keeps fewer rules:
     - The Core Rule Set reads the request without the `gitea_flash` and
@@ -847,6 +848,57 @@ every app, and no setting undoes them:
     site root. An app other than gitea that serves one of them must check these
     fields itself.
 
+9. On WordPress's paths, some fields skip the rules that refused ordinary
+   WordPress requests there. `internal/coreruleset/wordpress.conf` lists each
+   rule and the request it refused. The REST API has four addresses:
+    - `/wp-json/...`
+    - `/index.php/wp-json/...`
+    - `/index.php?rest_route=/...`
+    - `/?rest_route=/...`
+
+    The fields are:
+    - The header `X-HTTP-Method-Override` on any address of the REST API
+      (920450). The block editor saves a post with `POST` and names `PUT` in
+      this header.
+    - Three groups of fields skip the rules on system files and commands
+      (930120, 932120, 932250, 932260). The fields hold searches, names and
+      addresses of WordPress's own pages, and any of them can hold any word. The
+      groups are:
+        - On all of `/wp-admin/` and on `/wp-login.php`:
+            - the searches `s`, `search`, `q` and `term`;
+            - the names `tag`, `category_name`, `plugin`, `checked[]`, `theme`
+              and `stylesheet`;
+            - the addresses `url`, `return`, `redirect_to`, `wp_http_referer`
+              and `_wp_http_referer`.
+        - On every REST API route under `/wp/v2/` and on the route
+          `/oembed/1.0/embed`: `search`, `term`, `slug` and `url`.
+        - On `/`, `/index.php`, `/page/N/` and `/index.php/page/N/`: `s` and
+          `tag`.
+
+        The fields that hold an address also skip the rule on Unix commands
+        (932235), because an address repeats the search it came from. They are
+        `url`, `return`, `redirect_to`, `wp_http_referer` and `_wp_http_referer`
+        in the first group, and `url` in the second. The other fields of the
+        groups keep that rule.
+
+    - `_wp_http_referer` on `/wp-admin/upload.php`, for a Unix command given
+      without arguments (932340). The media list's own address ends in `&ps`.
+    - `file` on `/wp-admin/plugin-editor.php` and `/wp-admin/theme-editor.php`,
+      for the lists of system files, shell paths, command names and JavaScript
+      names (930120, 932120, 932160, 932260, 941180).
+    - These fields of a body. Each applies only when the query has no parameter
+      of that name, so it matters only while `SWW_WAF_BODY_LIMIT` is set:
+        - `content` of a post, a page, a template or a template part saved
+          through the REST API. It holds HTML and any code it shows.
+        - `content` of a reply to a comment sent to `admin-ajax.php`.
+        - `newcontent` of a plugin's or a theme's file saved from its editor,
+          which is PHP.
+        - `pwd` when signing in, for the list of system files (930120).
+
+    Elsewhere this change does not apply. The paths are those of WordPress at
+    the site root. An app other than WordPress that serves one of them must
+    check these fields itself.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.