Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352)

Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips
930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and
Forgejo's /admin/ alike, and in the body of the admin forms that adopt a
repository or activate an email. The issue and pull request searches of a
team and of a milestone join 900600 and 900601, as a repository's do. A
repository's packages page and the admin packages page join 900602, which
also skips 944130. 900605, which lets /bin/sh through in q on branches and
owner packages, now also covers the tags page and those two pages, since tag
and package names can hold a slash.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -1243,11 +1243,13 @@ func TestGiteaAttacksAreRefused(t *testing.T) {
 	}
 
 	// gitea has no owner named api, so these are not a repository's search,
-	// issues or pull requests. /api/v2/search is Mastodon's search.
+	// issues, pull requests or milestone page. /api/v2/search is Mastodon's
+	// search.
 	for _, path := range []string{
 		"/api/v2/search",
 		"/api/v2/issues",
 		"/api/v2/pulls",
+		"/api/v2/milestone/1",
 	} {
 		for _, attack := range []string{
 			sqlInjection,