Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- the web editor's tree_path, commit_summary and content;
- new_branch_name of a branch created on the web or the API;
- from and to of a renamed branch, on gitea's and Forgejo's paths;
- head of a pull request and message of a file, through the API.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

internal/coreruleset/recorded_test.go

@@ -150,9 +150,11 @@ func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 }
 
 // TestOrdinaryForgejoRequestsPass checks Forgejo's recorded requests at the
-// defaults only. While bodies are read, the Core Rule Set still refuses the
-// file and branch names some of them carry in a form or JSON body, as it does
-// gitea's (TestGiteaBodiesTheCoreRuleSetRefuses).
+// defaults only. While bodies are read, the Core Rule Set still refuses a new
+// wiki page whose title and text name commands and files, as it does such text
+// in gitea's comments (TestGiteaBodiesTheCoreRuleSetRefuses). The requests
+// that name a file or a branch in a body are checked while bodies are read in
+// TestForgejoNamesInBodiesPass.
 func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	t.Parallel()
 
@@ -168,6 +170,21 @@ func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	}
 }
 
+// TestGiteaNamesInBodiesPass checks gitea's recorded requests that name a
+// file or a branch in a body, while bodies are read too.
+func TestGiteaNamesInBodiesPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "gitea-names-in-bodies.txt")
+}
+
+// TestForgejoNamesInBodiesPass is TestGiteaNamesInBodiesPass for Forgejo.
+func TestForgejoNamesInBodiesPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "forgejo-names-in-bodies.txt")
+}
+
 func TestOrdinaryMastodonRequestsPass(t *testing.T) {
 	t.Parallel()