Core Rule Set: WordPress's ordinary requests pass by default (closes #235)

Add the ninth change: wordpress.conf switches off, per path and field, each
rule that refused recorded WordPress 7.1.4 traffic. Add the recorded requests,
a test at the defaults and reading bodies, and list WordPress in the README.

Model: opus-5-5

SPEC.md

@@ -81,7 +81,7 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/waf`: the Core Rule Set, with the eight changes listed under
+    - `internal/waf`: the Core Rule Set, with the nine changes listed under
       "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
@@ -674,7 +674,8 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions; the eighth change below holds gitea's.
+  holds an app's own exclusions; the eighth and ninth changes below hold gitea's
+  and WordPress's.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
       `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
@@ -720,9 +721,9 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in eight ways, since in front of
-gitea it would otherwise refuse ordinary requests. The changes hold in front of
-every app, and no setting undoes them:
+`smallwebwaf` changes the Core Rule Set 4.25.0 in nine ways, since in front of
+gitea and WordPress it would otherwise refuse ordinary requests. The changes
+hold in front of every app, and no setting undoes them:
 
 1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
    and `OPTIONS`. APIs, container image pushes and package uploads use them.
@@ -847,6 +848,23 @@ every app, and no setting undoes them:
     site root. An app other than gitea that serves one of them must check these
     fields itself.
 
+9. On WordPress's paths, some fields skip the rules that refused ordinary
+   WordPress requests there. `internal/waf/wordpress.conf` lists each rule and
+   the request it refused. The fields are:
+    - The header `X-HTTP-Method-Override` under `/wp-json/` (920450). The block
+      editor saves a post with `POST` and names `PUT` in this header.
+    - These fields of a body, which only matter while `SWW_WAF_BODY_LIMIT` is
+      set:
+        - `content` of a post or a page saved through the REST API. It holds the
+          post's HTML and any code it shows.
+        - `content` of a reply to a comment sent to `admin-ajax.php`.
+        - `newcontent` of a plugin's or a theme's file saved from its editor,
+          which is PHP.
+        - `pwd` when signing in, for the list of system files (930120).
+
+    Elsewhere these fields keep every rule. The paths are those of WordPress at
+    the site root.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.