Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352)

Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips
930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and
Forgejo's /admin/ alike, and in the body of the admin forms that adopt a
repository or activate an email. The issue and pull request searches of a
team and of a milestone join 900600 and 900601, as a repository's do. A
repository's packages page and the admin packages page join 900602, which
also skips 944130. 900605, which lets /bin/sh through in q on branches and
owner packages, now also covers the tags page and those two pages, since tag
and package names can hold a slash.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

SPEC.md

@@ -817,7 +817,10 @@ The changes hold in front of every app, and no setting undoes them:
    request it refused. The fields are:
     - `q` on gitea's searches of code, of issues and pull requests, and of
       commits. A code search holds code, such as `<script>`,
-      `SELECT * FROM users WHERE` or `../`.
+      `SELECT * FROM users WHERE` or `../`. The searches of issues and pull
+      requests include these:
+        - an organisation's issues and pull requests of one team;
+        - the issues and pull requests of one milestone.
     - `Referer` of a page opened from such a search, for script and SQL
       injection and Java code (941110, 941120, 941160, 942100, 944100).
     - `q` on gitea's searches for a name, for the lists of system files and
@@ -827,7 +830,10 @@ The changes hold in front of every app, and no setting undoes them:
         - repositories;
         - users and organisations;
         - branches and tags;
-        - packages, on its pages and in its API.
+        - packages, in its API and on these pages:
+            - an owner's packages page;
+            - a repository's packages page;
+            - the admin page of packages.
 
         A user's or an organisation's page has a path of one segment, such as
         `/alice`. So on any app, `q` skips these rules on every path of one
@@ -850,10 +856,31 @@ The changes hold in front of every app, and no setting undoes them:
         Some of these searches also skip the rule for Java class names (944130),
         which refused `org.apache.commons.logging`.
 
-        A branch or package name can hold a slash, as `feat/docker-support`
-        does. So `q` on a repository's branches page and on an owner's packages
-        page also skips the rule for shell paths (932160), which refused
-        `/bin/sh`.
+        A branch, tag or package name can hold a slash, as `feat/docker-support`
+        does. So `q` skips the rule for shell paths (932160) too on these pages,
+        where it refused `/bin/sh`:
+        - a repository's branches, tags and packages pages;
+        - an owner's packages page;
+        - the admin page of packages.
+
+    - `q` on gitea's other searches, for the same four rules. Words such as
+      `python3`, `powershell`, `ls -la` and `.htaccess` were refused there. The
+      searches are:
+        - the list of repositories a user watches;
+        - an organisation's milestones of one team;
+        - an organisation's search for teams;
+        - the milestones of a repository or an organisation;
+        - the projects of a repository, a user or an organisation;
+        - the versions of a package;
+        - the issues suggested when an issue is mentioned;
+        - the runner lists of the site, a user, an organisation and a
+          repository;
+        - the admin lists of users, organisations, repositories, unadopted
+          repositories and emails.
+
+        Most send `q` in the query string. The admin forms that adopt a
+        repository or activate an email send it in the body. gitea serves its
+        admin pages under `/-/admin/` and Forgejo under `/admin/`.
 
     - The path of these requests, which names a file:
         - a file's page;