Core Rule Set: WordPress's ordinary requests pass by default (closes #235)

Add the ninth change: wordpress.conf switches off, per path and field, each
rule that refused ordinary WordPress 7.1.4 requests. Add the recorded requests,
a test at the defaults and reading bodies, and list WordPress in the README.

Model: opus-5-5

SPEC.md

@@ -81,7 +81,7 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/waf`: the Core Rule Set, with the eight changes listed under
+    - `internal/waf`: the Core Rule Set, with the nine changes listed under
       "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
@@ -674,7 +674,8 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions; the eighth change below holds gitea's.
+  holds an app's own exclusions; the eighth and ninth changes below hold gitea's
+  and WordPress's.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
       `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
@@ -720,9 +721,9 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in eight ways, since in front of
-gitea it would otherwise refuse ordinary requests. The changes hold in front of
-every app, and no setting undoes them:
+`smallwebwaf` changes the Core Rule Set 4.25.0 in nine ways, since in front of
+gitea and WordPress it would otherwise refuse ordinary requests. The changes
+hold in front of every app, and no setting undoes them:
 
 1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
    and `OPTIONS`. APIs, container image pushes and package uploads use them.
@@ -847,6 +848,77 @@ every app, and no setting undoes them:
     site root. An app other than gitea that serves one of them must check these
     fields itself.
 
+9. On WordPress's paths, some fields skip the rules that refused ordinary
+   WordPress requests there. `internal/waf/wordpress.conf` lists each rule and
+   the request it refused. The REST API has four addresses:
+    - `/wp-json/...`
+    - `/index.php/wp-json/...`
+    - `/index.php?rest_route=/...`
+    - `/?rest_route=/...`
+
+    The fields are:
+    - The header `X-HTTP-Method-Override` on any address of the REST API
+      (920450). The block editor saves a post with `POST` and names `PUT` in
+      this header.
+    - `s` in WordPress's searches, for the lists of system files and command
+      names (930120, 932120, 932250, 932260). The pages are:
+        - `/` and `/index.php`;
+        - `/page/N/` and `/index.php/page/N/`, the later pages of a search;
+        - `/wp-admin/edit.php`;
+        - `/wp-admin/upload.php`;
+        - `/wp-admin/plugin-install.php`.
+    - `s` in the other searches of `wp-admin`, for the lists of command names
+      (932120, 932250, 932260). The pages are:
+        - `/wp-admin/edit-comments.php`;
+        - `/wp-admin/users.php`;
+        - `/wp-admin/plugins.php`;
+        - `/wp-admin/edit-tags.php`.
+    - `search` on every REST API route under `/wp/v2/`, for the lists of system
+      files and command names (930120, 932120, 932250, 932260).
+    - `search` in the searches of themes and of the media grid, for the lists of
+      command names (932120, 932250, 932260). The pages are:
+        - `/wp-admin/themes.php`;
+        - `/wp-admin/theme-install.php`;
+        - `/wp-admin/upload.php`.
+    - `q` and `term` on `/wp-admin/admin-ajax.php`, for the lists of command
+      names (932120, 932250, 932260). They carry the classic editor's tag field
+      and the search for a user to add.
+    - `term` on the REST API's route `/wp/v2/block-directory/search`, for the
+      same rules.
+    - `_wp_http_referer`, which holds the page's own address and so repeats the
+      last search, for the lists of system files and command names (930120,
+      932120, 932235, 932250, 932260, 932340). The pages are:
+        - `/wp-admin/edit.php`;
+        - `/wp-admin/edit-comments.php`;
+        - `/wp-admin/edit-tags.php`;
+        - `/wp-admin/plugin-install.php`;
+        - `/wp-admin/plugins.php`;
+        - `/wp-admin/theme-install.php`;
+        - `/wp-admin/themes.php`;
+        - `/wp-admin/upload.php`;
+        - `/wp-admin/users.php`.
+    - `tag` on `/`, `/index.php` and `/wp-admin/edit.php`, for the lists of
+      command names (932120, 932250, 932260).
+    - `category_name` on `/wp-admin/edit.php`, for the same rules.
+    - `file` on `/wp-admin/plugin-editor.php` and `/wp-admin/theme-editor.php`,
+      for the lists of system files, shell paths, command names and JavaScript
+      names (930120, 932120, 932160, 932260, 941180).
+    - `plugin`, for the lists of command names (932120, 932260). The pages are:
+        - `/wp-admin/plugin-editor.php`;
+        - `/wp-admin/plugins.php`;
+        - `/wp-admin/update.php`.
+    - These fields of a body. Each applies only when the query has no parameter
+      of that name, so it matters only while `SWW_WAF_BODY_LIMIT` is set:
+        - `content` of a post, a page, a template or a template part saved
+          through the REST API. It holds HTML and any code it shows.
+        - `content` of a reply to a comment sent to `admin-ajax.php`.
+        - `newcontent` of a plugin's or a theme's file saved from its editor,
+          which is PHP.
+        - `pwd` when signing in, for the list of system files (930120).
+
+    Elsewhere these fields keep every rule. The paths are those of WordPress at
+    the site root.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.