Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352)

Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips
930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and
Forgejo's /admin/ alike, and in the body of the admin forms that adopt a
repository or activate an email. 900605, which lets /bin/sh through in q on
branches and owner packages, now also covers the tags page, a repository's
packages page and the admin packages page, since tag and package names can
hold a slash.

Model: opus-5-5

SPEC.md

@@ -850,10 +850,32 @@ The changes hold in front of every app, and no setting undoes them:
         Some of these searches also skip the rule for Java class names (944130),
         which refused `org.apache.commons.logging`.
 
-        A branch or package name can hold a slash, as `feat/docker-support`
-        does. So `q` on a repository's branches page and on an owner's packages
-        page also skips the rule for shell paths (932160), which refused
-        `/bin/sh`.
+        A branch, tag or package name can hold a slash, as `feat/docker-support`
+        does. So `q` skips the rule for shell paths (932160) too on these pages,
+        where it refused `/bin/sh`:
+        - a repository's branches, tags and packages pages;
+        - an owner's packages page;
+        - the admin page of packages.
+
+    - `q` on gitea's other searches, for the same four rules. Words such as
+      `python3`, `powershell`, `ls -la` and `.htaccess` were refused there. The
+      searches are:
+        - the list of repositories a user watches;
+        - an organisation's issues, pull requests and milestones of one team;
+        - an organisation's search for teams;
+        - the milestones and projects of a repository, a user or an
+          organisation;
+        - the issues of one milestone;
+        - a repository's packages, and the versions of a package;
+        - the issues suggested when an issue is mentioned;
+        - the runner lists of the site, a user, an organisation and a
+          repository;
+        - the admin lists of users, organisations, repositories, unadopted
+          repositories, emails and packages.
+
+        Most send `q` in the query string. The admin forms that adopt a
+        repository or activate an email send it in the body. gitea serves its
+        admin pages under `/-/admin/` and Forgejo under `/admin/`.
 
     - The path of these requests, which names a file:
         - a file's page;