Core Rule Set: more of Drupal's ordinary fields pass (closes #244)

Names, searches and the page to return to on more Drupal paths skip
the rules that misfire on them: 930120, 932120, 932250 and 932260,
plus 932230 and 932235 on destination only. An email address skips
930120, 932120 and 932260; the oEmbed url only 930120 and 932120.
Every Drupal path may carry a language prefix: a first segment of two
or three lowercase letters, such as /fr. Requests recorded from Drupal
11.4.11 with plain words, python3, powershell, ls -la and .htaccess are
added to the test data; tests show attacks and "; wget ..." still
refused on each new field.

Model: opus-5-5

SPEC.md

@@ -928,14 +928,24 @@ changes hold in front of every app, and no setting undoes them:
     - On every page under `/admin`: `title`, `name`, `user`, `filename`,
       `filemime`, `info`, `subject`, `author_name`, `search`, `q` and
       `destination`.
-    - `destination` on the pages Drupal links to with one, such as
-      `/node/1/edit`, `/user/login` and `/user/logout`.
+    - `destination` on the pages Drupal links to with one, such as these:
+        - `/node/1/edit`;
+        - `/user/login`;
+        - `/node/1/revisions/2/revert`;
+        - `/block/add/basic`;
+        - `/big_pipe/no-js`.
     - `keys` on `/search` and the pages under it.
-    - `q` on `/entity_reference_autocomplete/`.
+    - `q` on these autocompletes:
+        - `/entity_reference_autocomplete/`;
+        - `/ckeditor5/{editor}/entity-link-suggestions`;
+        - `/block-category/autocomplete`.
     - Every `filter[...]` field on `/jsonapi/`.
+    - `name` on `/user/password`, `/media-library` and `/views/ajax`, in the
+      query or a body.
 
     `destination` also skips 932230 and 932235, because it holds the address of
-    a page of results.
+    a page of results. `url` on `/media/oembed`, the address of a video, skips
+    only 930120 and 932120.
 
     These fields of a body skip the rules that refused them:
     - On the node, comment and media forms, for 930120, 932120, 932250 and
@@ -948,18 +958,35 @@ changes hold in front of every app, and no setting undoes them:
         - the comment subject;
         - the media name;
         - the image text.
-    - `title`, `subject` and `body.summary` through JSON:API, for the same four
-      rules.
-    - The body and comment body on those forms and through JSON:API, which hold
-      HTML and any code it shows.
-    - `pass` when signing in (930120, 932120, 932250, 932260).
+    - On the tag, custom block and contact forms, for the same four rules:
+        - the tag's name and description;
+        - the block description and body;
+        - the subject and message of a contact message.
+    - These fields through JSON:API, for the same four rules:
+        - `title`;
+        - `subject`;
+        - `body.summary`;
+        - `name`;
+        - `revision_log`;
+        - `info`;
+        - `description.value`.
+    - The title saved through Drupal's JSON format on `/node/{id}`, for the same
+      four rules.
+    - The body and comment body on the node and comment forms and through
+      JSON:API, which hold HTML and any code it shows.
+    - `name` and `pass` when signing in (930120, 932120, 932250, 932260).
+    - `name` when signing up, editing an account and commenting without an
+      account, for the same four rules.
+    - `mail` on those forms, for 930120, 932120 and 932260 only.
 
     These exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None applies
     when the query has a parameter of the same name.
 
     Elsewhere these fields keep every rule. The paths are those of Drupal at the
-    site root. An app other than Drupal that serves one of them must check these
-    fields itself.
+    site root, with or without a language prefix such as `/fr`. Such a prefix is
+    any first path segment of two or three lowercase letters, optionally
+    followed by a hyphen and more letters, so `/api` counts too. An app other
+    than Drupal that serves one of them must check these fields itself.
 
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.