Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- tree_path, commit_summary and content on the web editor's pages:
  edit, new file, delete, upload, patch, cherry-pick and preview;
- fields that name a branch, for Windows commands and command names:
  new_branch_name, old_branch_name, old_ref_name, from, to, head, base,
  branch and new_branch; base also when a pull request is edited
  through the API;
- message of one file or several changed through the API, for system
  files and Windows commands.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

internal/coreruleset/recorded_test.go

@@ -206,9 +206,11 @@ func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 // TestOrdinaryForgejoRequestsPass checks Forgejo's recorded requests at the
 // defaults only: with SWW_APPS unset, and on example.com, where they were
 // recorded, while SWW_APPS lists only forgejo for it. While bodies are read,
-// the Core Rule Set still refuses the file and branch names some of them
-// carry in a form or JSON body, as it does gitea's
-// (TestGiteaBodiesTheCoreRuleSetRefuses).
+// the Core Rule Set still refuses a new wiki page whose title and text name
+// commands and files, as it does such text in gitea's comments
+// (TestGiteaBodiesTheCoreRuleSetRefuses). The requests that name a file or a
+// branch in a body are checked while bodies are read in
+// TestForgejoNamesInBodiesPass.
 func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	t.Parallel()
 
@@ -236,6 +238,21 @@ func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	}
 }
 
+// TestGiteaNamesInBodiesPass checks gitea's recorded requests that name a
+// file or a branch in a body, while bodies are read too.
+func TestGiteaNamesInBodiesPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "gitea-names-in-bodies.txt", gitea)
+}
+
+// TestForgejoNamesInBodiesPass is TestGiteaNamesInBodiesPass for Forgejo.
+func TestForgejoNamesInBodiesPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "forgejo-names-in-bodies.txt", forgejo)
+}
+
 func TestOrdinaryMastodonRequestsPass(t *testing.T) {
 	t.Parallel()