Core Rule Set: random passwords pass on the multisite network profile page (closes #300)

/wp-admin/network/profile.php posts pass1 and pass2 to itself. The
exclusion that lets them skip the random-password rules on WordPress's
other profile pages now names it too.

Model: opus-5-5

internal/coreruleset/wordpress.conf

@@ -139,10 +139,10 @@ SecRule REQUEST_FILENAME "@streq /wp-login.php" \
 # The other passwords, which skip the same rules:
 #   pass1, pass2: resetting the password at /wp-login.php, changing it on the
 #   profile page and the page that edits a user, and adding a user; a
-#   multisite install also changes it on network/user-edit.php and
-#   user/profile.php
+#   multisite install also changes it on network/user-edit.php,
+#   network/profile.php and user/profile.php
 #   post_password: the password of a protected post, sent to /wp-login.php
-SecRule REQUEST_FILENAME "@rx ^/(?:wp-login\.php|wp-admin/(?:profile|user-edit|user-new|network/user-edit|user/profile)\.php)$" \
+SecRule REQUEST_FILENAME "@rx ^/(?:wp-login\.php|wp-admin/(?:profile|user-edit|user-new|network/user-edit|network/profile|user/profile)\.php)$" \
     "id:900715,phase:1,pass,nolog,chain"
     SecRule &ARGS_GET:/^(?:pass[12]|post_password)$/ "@eq 0" \
         "ctl:ruleRemoveTargetById=920270;ARGS:/^(?:pass[12]|post_password)$/,\