Core Rule Set: Nextcloud's ordinary requests pass by default (closes #240)

Adds nextcloud.conf, the twelfth change. Nextcloud's WebDAV paths allow
PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT and SEARCH. The account-name
cookie nc_username, and the fields that carry a search, a name, a file name or
a folder on the sign-in page, the Files app, public shares and the OCS API,
skip the four rules that read them as commands or system files. Comments and
the text editor's document skip the two rules for a command after a ";" too;
932235 keeps "; wget" refused. Requests recorded from Nextcloud 35.0.2, its
web pages, sync client 3.16.7 with chunked uploads and the OCS API, pass at
the defaults and while bodies are read.

Model: opus-5-5

README.md

@@ -581,22 +581,24 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in eleven ways so that ordinary
-  requests get through to a code forge, to WordPress, to Drupal and to
-  MediaWiki. They include git over HTTP and sign-in through Git Credential
-  Manager on a code forge, and saving a post from the block editor on WordPress.
-  On gitea's own paths, its searches, file names and branch names get through
-  too. On WordPress's own paths, its searches, names and file names do. On
-  Drupal's own paths, the page to return to, its searches and its names get
+- `smallwebwaf` changes the Core Rule Set in twelve ways so that ordinary
+  requests get through to a code forge, to WordPress, to Drupal, to MediaWiki
+  and to Nextcloud. They include git over HTTP and sign-in through Git
+  Credential Manager on a code forge, and saving a post from the block editor on
+  WordPress. On gitea's own paths, its searches, file names and branch names get
+  through too. On WordPress's own paths, its searches, names and file names do.
+  On Drupal's own paths, the page to return to, its searches and its names get
   through too. On MediaWiki's own paths, its searches, page titles, names and
-  wikitext do. No setting undoes the changes; "Attack detection" in
-  [`SPEC.md`](SPEC.md) lists them.
+  wikitext do. On Nextcloud's own paths, its WebDAV methods, searches, file
+  names, account names and comments do. No setting undoes the changes; "Attack
+  detection" in [`SPEC.md`](SPEC.md) lists them.
 - These apps work out of the box at the default settings, and their recorded
   ordinary requests pass the Core Rule Set:
     - gitea;
     - WordPress;
     - Drupal;
-    - MediaWiki.
+    - MediaWiki;
+    - Nextcloud, with its sync client.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again