Core Rule Set tests: name repeated attack strings (closes #263)

The Drupal and MediaWiki tests repeated the SQL and script attack strings,
which goconst reports. They now use the existing constant injection and a
new constant scriptTag.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -1357,6 +1357,9 @@ const (
 // injection is an SQL injection, which rule 942100 matches.
 const injection = "1' OR '1'='1"
 
+// scriptTag is a script injection, not escaped.
+const scriptTag = "<script>alert(1)</script>"
+
 // readingBodies returns the Core Rule Set as sww runs it by
 // default, but reading bodies up to bodyLimit.
 func readingBodies(t *testing.T) *coreruleset.CoreRuleSet {