Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- tree_path, commit_summary and content on the web editor's pages:
  edit, new file, delete, upload, patch, cherry-pick and preview;
- fields that name a branch, for Windows commands and command names:
  new_branch_name, old_branch_name, old_ref_name, from, to, head, base,
  branch and new_branch; base also when a pull request is edited
  through the API;
- message of one file or several changed through the API, for system
  files and Windows commands.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

internal/coreruleset/forgejo.conf

@@ -128,4 +128,18 @@ SecRule REQUEST_FILENAME \
 SecRule REQUEST_FILENAME "@streq /admin/repos" \
     "id:900691,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:q"
 
+# Forgejo renames a branch on its own path, where from and to name branches.
+# They skip these rules:
+#   932120: fix-powershell-module
+#   932260: feat/docker-support
+# They are read only while SWW_WAF_BODY_LIMIT is set, and skip nothing when the
+# query has a parameter of the same name.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/rename_branch$" \
+    "id:900666,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:from|to)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:from,\
+        ctl:ruleRemoveTargetById=932260;ARGS:from,\
+        ctl:ruleRemoveTargetById=932120;ARGS:to,\
+        ctl:ruleRemoveTargetById=932260;ARGS:to"
+
 SecMarker END_FORGEJO