Core Rule Set: random passwords pass at sign-in (closes #276)

A password manager's random password set off 35 Core Rule Set rules,
about 1 in 40 refused. The password fields the app exclusions name now
skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki
wpPassword, lgpassword and password, Mastodon's sign-in, sign-up,
password change, move and delete passwords, and Nextcloud's sign-in
password. The tests draw 2,000 random passwords from a fixed seed, plus
one rare password for each rule the 2,000 do not set off. Those that set
off a rule in a field no exclusion names are sent to every password
field. An SQL injection or a path traversal sent as a password now
passes; a script injection is still refused.

Model: opus-5-5

internal/coreruleset/drupal_test.go

@@ -109,7 +109,6 @@ func TestDrupalAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 			{reply, "comment_body%5B0%5D%5Bvalue%5D=" + attack},
 			{reply, "subject%5B0%5D%5Bvalue%5D=" + attack},
 			{reply, drupalName + attack},
-			{drupalSignIn, "pass=" + attack},
 			{drupalSignIn, drupalName + attack},
 			{"/fr/user/login", drupalName + attack},
 			{"/user/register", drupalName + attack},
@@ -172,6 +171,25 @@ func TestDrupalAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 	}
 }
 
+func TestDrupalPasswordPasses(t *testing.T) {
+	t.Parallel()
+
+	for _, r := range []request{
+		{http.MethodPost, drupalSignIn, []string{formData}},
+		{http.MethodPost, drupalJSONSignIn, []string{jsonBody}},
+	} {
+		t.Run(r.target, func(t *testing.T) {
+			t.Parallel()
+
+			wantRandomPasswordsPass(t, r, "pass")
+
+			// No rule pass keeps catches the SQL injection or the path
+			// traversal.
+			wantPasswordAttacksRefused(t, r, "pass", scriptTag)
+		})
+	}
+}
+
 func TestDrupalAttacksAreRefusedInTheJSONPasswordReset(t *testing.T) {
 	t.Parallel()