Core Rule Set: MediaWiki's password fields pass on a wiki in any language (closes #299)

A wiki in another language posts its sign-up, password change and
new-password forms to its own names for the special pages, such as
Spezial:Benutzerkonto_anlegen. So password and retype no longer match on
the English page name. They skip the rules when authAction names the
form that sends them: change, create or login-continue. MediaWiki sends
the same value in every language. The page must still be MediaWiki's,
with a namespace in its title, so another app's paths under /index.php/
keep every rule. The two rules move to phase 2 to read the body.

Adds requests recorded from a German MediaWiki 1.46.2.

Model: opus-5-5

SPEC.md

@@ -1139,10 +1139,12 @@ The changes hold in front of every app, and no setting undoes them:
         - `source` in the JSON body of `/rest.php/`.
     - The passwords when signing in, signing up and changing a password:
         - `wpPassword` on MediaWiki's pages;
-        - `password` and `retype` on `Special:ChangeCredentials`;
-        - `retype` on `Special:CreateAccount`;
-        - `retype` on `Special:UserLogin`, where a password reset sets the new
-          password;
+        - `password` and `retype` on `Special:ChangeCredentials`, whose form
+          sends `authAction=change`;
+        - `retype` on `Special:CreateAccount`, whose form sends
+          `authAction=create`;
+        - `retype` on `Special:UserLogin`, where a password reset or an expired
+          password sets the new password with `authAction=login-continue`;
         - `lgpassword`, `password` and `retype` on `/api.php`.
 
         They skip each rule that random passwords set off:
@@ -1156,9 +1158,12 @@ The changes hold in front of every app, and no setting undoes them:
         `<img src=x onerror=x()>` sent as a password reach MediaWiki;
         `<script>alert(1)</script>` and `javascript:alert(1)` are still refused.
 
-        The path must name the special page, or be `/index.php` with a `title`
-        that names it. Other apps use `password` and `retype` too, so on any
-        other page those two fields keep every rule.
+        Other apps use `password` and `retype` too. So those two fields skip
+        these rules only when `authAction` names the form that sends them. The
+        page's name does not count, because a wiki in another language posts
+        these forms to its own names, such as `Spezial:Benutzerkonto_anlegen`.
+        The page's title must have a namespace, such as `Special:`. The title is
+        after the path, or in the `title` of `/index.php`.
 
     These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
     applies when the query has a parameter of the same name.