SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

Each app's fixes are one .conf file and one entry in apps. They apply
only while Inspect has set the app's transaction variable, such as
tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only
its apps' fixes; while SWW_APPS is unset, every hostname gets every
app's fixes. Listing forgejo, a fork of gitea, brings gitea's fixes too.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

internal/coreruleset/forgejo.conf

@@ -1,9 +1,16 @@
-# The fifteenth change: on Forgejo's paths, some fields skip the rules that
-# refused ordinary Forgejo requests there. Forgejo is a fork of gitea, and the
-# eighth change's fixes for gitea apply to its requests too, so this file holds
-# only what Forgejo sends and gitea does not. Each exclusion runs with the
-# request, before the rules it switches off, so this file is loaded before the
-# Core Rule Set's rules. Each comment names a request the rule refused.
+# Forgejo's fixes: on Forgejo's paths, some fields skip the rules that refused
+# ordinary Forgejo requests there. Forgejo is a fork of gitea. A hostname that
+# gets Forgejo's fixes gets gitea's too, so this file holds only what Forgejo
+# sends and gitea does not. Each exclusion runs with the request, before the
+# rules it switches off, so this file is loaded before the Core Rule Set's
+# rules. Each comment names a request the rule refused.
+
+# Every rule below is skipped unless Inspect has set tx.app_forgejo. It sets it
+# while SWW_APPS is unset, or lists forgejo for the request's hostname.
+# The skip reaches only phase 1, so a rule of a later phase must check
+# tx.app_forgejo itself.
+SecRule &TX:app_forgejo "@eq 0" \
+    "id:900670,phase:1,pass,nolog,skipAfter:END_FORGEJO"
 
 # Forgejo's search of a wiki sends the text searched for in q, which skips
 # these rules there:
@@ -115,3 +122,10 @@ SecRule REQUEST_FILENAME \
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
     ctl:ruleRemoveTargetById=932250;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
+
+# Forgejo's admin page searches the names of repositories in q on /admin/repos,
+# which skips the list of command names (932260) there. It refused python3.
+SecRule REQUEST_FILENAME "@streq /admin/repos" \
+    "id:900691,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:q"
+
+SecMarker END_FORGEJO