Core Rule Set: Ghost's ordinary requests pass by default (closes #357)

Ghost 6.76.0's ordinary traffic, recorded in `testdata/ghost-requests.txt`,
passes at the default settings and while bodies are read. It covers public
pages, members' sign-up and sign-in, the admin, the editor saving and
publishing posts and pages with code blocks and HTML cards, tags, settings,
staff invitations, uploads, newsletter settings, and both APIs. The new
`ghost.conf`, the sixteenth change, lets through `filter`, the member
`search` and the embed `url` in the query, and plain text, addresses,
articles, code injection and passwords in JSON bodies. A `<script>` element
and a `javascript:` link stay refused in articles and code injection.
`README.md` lists Ghost; `SPEC.md` lists the change.

Model: opus-5-5

README.md

@@ -581,7 +581,7 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in fifteen ways so that ordinary
+- `smallwebwaf` changes the Core Rule Set in sixteen ways so that ordinary
   requests get through to the apps listed below. No setting undoes the changes;
   "Attack detection" in [`SPEC.md`](SPEC.md) lists them.
 - These apps work out of the box at the default settings, and their recorded
@@ -605,9 +605,12 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
     - Nextcloud: its sync client gets through. On Nextcloud's own paths, its
       WebDAV methods, searches, file names, account names, comments and
       documents do too.
+    - Ghost: saving and publishing from its editor gets through, HTML included.
+      On Ghost's own paths, its filters, searches, names, email addresses, code
+      injection and settings do too.
 - A random password, as a password manager makes one, gets through these forms:
     - signing in, signing up, and changing or resetting a password, on
-      WordPress, Drupal, MediaWiki, Mastodon, Nextcloud and gitea;
+      WordPress, Drupal, MediaWiki, Mastodon, Nextcloud, gitea and Ghost;
     - moving or deleting the account, on Mastodon;
     - deleting the account, on gitea;
     - the admin page, on Vaultwarden, whose apps send a hash of the master