Core Rule Set: WordPress's ordinary requests pass by default (closes #235)

Add the ninth change: wordpress.conf switches off, per path and field, each
rule that refused recorded WordPress 7.1.4 traffic. Add the recorded requests,
a test at the defaults and reading bodies, and list WordPress in the README.

Model: opus-5-5

README.md

@@ -581,11 +581,15 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in eight ways so that it lets ordinary
+- `smallwebwaf` changes the Core Rule Set in nine ways so that it lets ordinary
   requests to a code forge through, such as git over HTTP and sign-in through
   Git Credential Manager. On gitea's own paths, its searches, file names and
   branch names get through too. No setting undoes the changes; "Attack
   detection" in [`SPEC.md`](SPEC.md) lists them.
+- These apps work out of the box at the default settings, and the Core Rule Set
+  refuses none of their ordinary requests:
+    - gitea;
+    - WordPress.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again