Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- the web editor's tree_path, commit_summary and content;
- new_branch_name of a branch created on the web or the API;
- from and to of a renamed branch, on gitea's and Forgejo's paths;
- head of a pull request and message of a file, through the API.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

internal/coreruleset/forgejo.conf

@@ -19,3 +19,14 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
     ctl:ruleRemoveTargetById=932160;ARGS:q,\
     ctl:ruleRemoveTargetById=932250;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
+
+# Forgejo renames a branch on its own path, where from and to name branches.
+# They skip the list of command names (932260), which refused
+# feat/docker-support and feat/python3-support. They are read only while
+# SWW_WAF_BODY_LIMIT is set, and skip nothing when the query has a parameter of
+# the same name.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/rename_branch$" \
+    "id:900666,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:from|to)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932260;ARGS:from,\
+        ctl:ruleRemoveTargetById=932260;ARGS:to"