Core Rule Set: Vaultwarden's ordinary requests pass by default (closes #239)

Adds vaultwarden.conf, the twelfth change. On Vaultwarden's account,
organization and admin paths, names and password hints skip 930120,
932120, 932250 and 932260, and email addresses skip 932120 and 932260.
The data breach report's address does too. The encrypted names of uploaded
attachments and file sends skip 920120. Requests recorded from
Vaultwarden 1.37.5 through the web vault, the Bitwarden command line
client and the admin page pass at the defaults and while bodies are read.

Model: opus-5-5

internal/coreruleset/coreruleset.go

@@ -1,6 +1,6 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the eleven changes sww
+// body while SWW_WAF_BODY_LIMIT is set, with the twelve changes sww
 // makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
@@ -34,7 +34,8 @@ import (
 // paranoia level for %d, bodyDirectives for the first %s while
 // SWW_WAF_BODY_LIMIT is set, the exclusions file for the second,
 // giteaExclusions for the third, wordpressExclusions for the fourth,
-// drupalExclusions for the fifth, and mediawikiExclusions for the sixth.
+// drupalExclusions for the fifth, mediawikiExclusions for the sixth, and
+// vaultwardenExclusions for the seventh.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
@@ -91,7 +92,10 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
 # So does the tenth.
 %s
 
-# And the eleventh.
+# So does the eleventh.
+%s
+
+# And the twelfth.
 %s
 
 # The sixth: only the rules for requests are loaded, and no response is
@@ -206,6 +210,13 @@ var drupalExclusions string
 //go:embed mediawiki.conf
 var mediawikiExclusions string
 
+// vaultwardenExclusions are the twelfth change: the fields of Vaultwarden's
+// own requests that skip the rules that refused them there, as Coraza
+// directives.
+//
+//go:embed vaultwarden.conf
+var vaultwardenExclusions string
+
 // cookiesNotRead are the cookies the Core Rule Set reads a request
 // without, the rest of the fifth change.
 //
@@ -319,7 +330,7 @@ type CoreRuleSet struct {
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the eleven changes, at params'
+// New returns the Core Rule Set with the twelve changes, at params'
 // paranoia level, without the rules it switches off, reading request
 // bodies up to params' limit, and with params' exclusions file loaded
 // before the Core Rule Set's rules. An exclusions file is an error if it
@@ -348,7 +359,7 @@ func New(params Params) (*CoreRuleSet, error) {
 
 	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
 		giteaExclusions, wordpressExclusions, drupalExclusions,
-		mediawikiExclusions)
+		mediawikiExclusions, vaultwardenExclusions)
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))