Core Rule Set: Forgejo's ordinary requests pass by default (closes #342)

Forgejo 17.0.1's recorded requests are in
testdata/forgejo-requests.txt, checked at the defaults.

What Forgejo sends and gitea does not:
- its flash cookie is named flash, which joins gitea_flash among the
  cookies left out;
- its wiki search, whose q skips five rules in forgejo.conf, the
  fifteenth change.

Gaps in gitea's fixes the recording showed: q on the name searches
skips 932250 (ls -la), and the API's package search is one of them.
User and organisation pages, any one-segment path, keep 932250.

Model: opus-5-5

internal/coreruleset/gitea.conf

@@ -102,13 +102,16 @@ SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
 # name in q, which skips these rules there:
 #   930120: .profile
 #   932120: powershell-scripts
+#   932250: ls -la
 #   932260: python3-app
 #   944130: org.apache.commons.logging
 SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
-    [^/]+/-/packages|[^/]+/[^/]+/(?:branches|tags)|api/v1/repos/search)$" \
+    [^/]+/-/packages|[^/]+/[^/]+/(?:branches|tags)|api/v1/repos/search|\
+    api/v1/packages/[^/]+)$" \
     "id:900602,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=930120;ARGS:q,\
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932250;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q,\
     ctl:ruleRemoveTargetById=944130;ARGS:q"
 
@@ -116,19 +119,31 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
 # rules there:
 #   930120: .profile
 #   932120: powershell-scripts
+#   932250: ls -la
 #   932260: python3-app
 # The searches:
 #   - the dashboard's filter of repositories;
-#   - the repositories on a user's or an organisation's page, whose path has
-#     one segment;
 #   - the author filter of the issue and pull request lists;
 #   - the lists of users and organisations, and the API's search for users.
-SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+|repo/search|\
+SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|\
     explore/(?:users|organizations)|api/v1/users/search|\
     [^/]+/[^/]+/(?:issues|pulls)/posters)$" \
     "id:900603,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=930120;ARGS:q,\
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932250;ARGS:q,\
+    ctl:ruleRemoveTargetById=932260;ARGS:q"
+
+# The repositories on a user's or an organisation's page are searched with q
+# too. Their path has one segment, as other apps' pages such as /index.php do,
+# so q keeps 932250 there and skips only these rules:
+#   930120: .profile
+#   932120: powershell-scripts
+#   932260: python3-app
+SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
+    "id:900604,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932120;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
 # These requests name a file in the path, which skips these rules there: