Core Rule Set: Vaultwarden's ordinary requests pass by default (closes #239)

Adds vaultwarden.conf, the twelfth change. On Vaultwarden's account,
organization and admin paths, names and password hints skip 930120,
932120, 932250 and 932260, and email addresses skip 932120 and 932260.
The data breach report's address does too. The encrypted names of uploaded
attachments and file sends skip 920120. Requests recorded from
Vaultwarden 1.37.5 through the web vault, the Bitwarden command line
client and the admin page pass at the defaults and while bodies are read.

Model: opus-5-5

SPEC.md

@@ -81,7 +81,7 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/coreruleset`: the Core Rule Set, with the eleven changes listed
+    - `internal/coreruleset`: the Core Rule Set, with the twelve changes listed
       under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
@@ -676,8 +676,8 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions; the eighth to eleventh changes below hold
-  gitea's, WordPress's, Drupal's and MediaWiki's.
+  holds an app's own exclusions; the eighth to twelfth changes below hold
+  gitea's, WordPress's, Drupal's, MediaWiki's and Vaultwarden's.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
       `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
@@ -723,9 +723,10 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in eleven ways, since in front of
-gitea, WordPress, Drupal and MediaWiki it would otherwise refuse ordinary
-requests. The changes hold in front of every app, and no setting undoes them:
+`smallwebwaf` changes the Core Rule Set 4.25.0 in twelve ways, since in front of
+gitea, WordPress, Drupal, MediaWiki and Vaultwarden it would otherwise refuse
+ordinary requests. The changes hold in front of every app, and no setting undoes
+them:
 
 1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
    and `OPTIONS`. APIs, container image pushes and package uploads use them.
@@ -756,10 +757,10 @@ requests. The changes hold in front of every app, and no setting undoes them:
     catch reaches the app, such as the command `|cat /etc/passwd`. Path
     traversal, SQL and script injection, and PHP, Java and Node.js code are
     still refused there. Other parameters keep all three rules, except on the
-    gitea, WordPress, Drupal and MediaWiki paths the eighth to eleventh changes
-    name. An app that uses one of these parameters as a file on the server, or
-    passes it to a shell, must check the value itself. A rule file can refuse it
-    instead.
+    gitea, WordPress, Drupal, MediaWiki and Vaultwarden paths the eighth to
+    twelfth changes name. An app that uses one of these parameters as a file on
+    the server, or passes it to a shell, must check the value itself. A rule
+    file can refuse it instead.
 
 5. Two cookies are left out, and `Referer` keeps fewer rules:
     - The Core Rule Set reads the request without the `gitea_flash` and
@@ -1071,6 +1072,53 @@ requests. The changes hold in front of every app, and no setting undoes them:
     the site root or under `/w/`. An app other than MediaWiki that serves one of
     them must check these fields itself.
 
+12. On Vaultwarden's paths, some fields skip the rules that refused ordinary
+    Vaultwarden requests there. `internal/coreruleset/vaultwarden.conf` lists
+    each rule and the request it refused. The apps encrypt vault items, folders,
+    collections and sends before sending them, so those fields skip no rules.
+    The fields below hold plain text.
+
+    Names and password hints skip the lists of system files and command names
+    (930120, 932120, 932250, 932260):
+    - `name`, the name of the account, an organization or a group;
+    - `masterPasswordHint`, when signing up or changing the master password;
+    - `invitation_org_name` and `smtp_from_name`, on the admin page's settings.
+
+    Email addresses skip 932120 and 932260 alone, so `python3@example.com` and
+    `powershell@example.com` pass:
+    - `username`, when signing in at `/identity/connect/token`;
+    - `email`, `newEmail`, `billingEmail` and the invited `emails`;
+    - the salt fields, such as `masterPasswordUnlock.salt`, which hold the
+      address;
+    - `smtp_from`, on the admin page's settings.
+
+    These fields skip the rules on these paths:
+    - the paths under `/identity/accounts/`;
+    - `/api/accounts/`, `/api/emergency-access/` and `/api/organizations`, and
+      the paths under them;
+    - `/admin/config`.
+
+    The addresses skip the rules on `/identity/connect/token` and
+    `/admin/invite` too.
+
+    These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
+    applies when the query has a parameter of the same name.
+
+    `username` in the query of `/api/hibp/breach`, the data breach report, skips
+    932120 and 932260 too.
+
+    The names of uploaded files skip 920120 on the paths that take attachments
+    and file sends:
+    - `/api/ciphers/<id>/attachment` and the paths under it;
+    - `/api/ciphers/<id>/attachment-admin`;
+    - `/api/sends/<id>/file/<file id>`.
+
+    The apps name such a file by its encrypted name, which holds `=`. Path
+    traversal and PHP scripts in the names are still refused.
+
+    Elsewhere these fields keep every rule. An app other than Vaultwarden that
+    serves one of these paths must check these fields itself.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.