Core Rule Set: Forgejo's ordinary requests pass by default (closes #342)

Forgejo 17.0.1's recorded requests are in
testdata/forgejo-requests.txt, checked at the defaults.

What Forgejo sends and gitea does not:
- its flash cookie is named flash, which joins gitea_flash among the
  cookies left out;
- its wiki search, whose q skips five rules in forgejo.conf, the
  fifteenth change.

Gaps in gitea's fixes the recording showed: q on the name searches
skips 932250 (ls -la), and the API's package search is one of them.
User and organisation pages, any one-segment path, keep 932250.

Model: opus-5-5

internal/coreruleset/forgejo.conf

@@ -0,0 +1,21 @@
+# The fifteenth change: on Forgejo's paths, some fields skip the rules that
+# refused ordinary Forgejo requests there. Forgejo is a fork of gitea, and the
+# eighth change's fixes for gitea apply to its requests too, so this file holds
+# only what Forgejo sends and gitea does not. Each exclusion runs with the
+# request, before the rules it switches off, so this file is loaded before the
+# Core Rule Set's rules. Each comment names a request the rule refused.
+
+# Forgejo's search of a wiki sends the text searched for in q, which skips
+# these rules there:
+#   930120: .htaccess
+#   932120: powershell
+#   932160: /bin/sh
+#   932250: ls -la
+#   932260: python3
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
+    "id:900680,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932160;ARGS:q,\
+    ctl:ruleRemoveTargetById=932250;ARGS:q,\
+    ctl:ruleRemoveTargetById=932260;ARGS:q"