Gitea setup: Core Rule Set blocks attacks, not ordinary Gitea traffic (closes #198)

The Gitea setup runs the Core Rule Set in block mode. Rules that refused
ordinary Gitea requests are switched off only where they misfired:

- deploy/gitea/crs-exclusions.conf, loaded through the new setting
  SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE, covers Gitea's search, file-name
  and branch-name fields, Referer, and file paths;
- smallwebwaf's defaults gain a seventh change: the registry upload
  path's from parameter skips 932260.

A file that cannot be read, does not parse or names an id from 900000
to 900999 stops servewaf at start. internal/waf's tests and
script/gitea-setup send the recorded requests in
internal/waf/testdata/gitea-requests.txt and three attacks.

Model: opus-5-5

README.md

@@ -192,9 +192,9 @@ account, a key, a token or an alert destination stays off until you give one.
 - Any `SWWAF_` setting can be given as a file instead, for secrets and long
   lists: `SWWAF_ADMIN_TOKEN_FILE` names the file that holds `SWWAF_ADMIN_TOKEN`.
   The file's contents are the value, less one newline at the end. Setting both
-  forms stops the start. `SWWAF_LOG_REMOTE_TLS_CA_FILE` already names a file, so
-  it has no `_FILE` form, and no `SWRP_` setting has one, since `rproxy` never
-  touches disk.
+  forms stops the start. `SWWAF_LOG_REMOTE_TLS_CA_FILE` and
+  `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE` already name a file, so they have no
+  `_FILE` form. No `SWRP_` setting has one, since `rproxy` never touches disk.
 - A duration is Go's syntax, with `d` for days: `90s`, `15m`, `24h`, `7d`.
 - A size is a number of bytes with an optional `K`, `M` or `G`, in powers of
   1024: `512K`, `100M`, `5G`.
@@ -272,6 +272,7 @@ Every setting the code reads, with its default:
 | `SWWAF_WAF_DISABLED_RULES`                 | `920340,920420,920440,920640,930130,930140`                                    | Core Rule Set rule ids switched off; a list you give replaces the default, so repeat these six to keep them off.                                                    |
 | `SWWAF_WAF_EXEMPT_PATHS`                   | empty                                                                          | Path prefixes the Core Rule Set does not inspect.                                                                                                                   |
 | `SWWAF_WAF_BODY_LIMIT`                     | `off`                                                                          | How much of a request body the Core Rule Set reads, a size up to `64K`; `off` reads none.                                                                           |
+| `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE`      | unset                                                                          | A file of Core Rule Set exclusions, as Coraza directives, that switch rules off for some fields or paths only; `deploy/gitea/crs-exclusions.conf` is gitea's.       |
 | `SWWAF_BLOCKLIST_URLS`                     | empty                                                                          | Blocklists to fetch, text files of addresses and netblocks one to a line, such as `https://www.spamhaus.org/drop/drop.txt`.                                         |
 | `SWWAF_BLOCKLIST_REFRESH`                  | `24h`                                                                          | How long after a list was last tried it is fetched again, `1h` or more.                                                                                             |
 | `SWWAF_BLOCKLIST_ACTION`                   | `deny`                                                                         | What a client on a blocklist gets: `deny`, `limit:<percent>` of every limit, or `log`.                                                                              |
@@ -636,10 +637,14 @@ and the status for a size or time limit, such as `413` for a body too large.
   headers of every request, and no body unless `SWWAF_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in six ways so that it lets ordinary
+- `smallwebwaf` changes the Core Rule Set in seven ways so that it lets ordinary
   requests to a code forge through, such as git over HTTP and sign-in through
   Git Credential Manager. No setting undoes them; "Attack detection" in
   [`SPEC.md`](SPEC.md) lists them.
+- `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's
+  own fields or paths. gitea's exclusions, in
+  `deploy/gitea/crs-exclusions.conf`, let its searches, file names and branch
+  names through.
 - Rule files are plain text, one rule to a line, edited by hand and read again
   while `servewaf` runs. The image ships one file of probes no real visitor
   sends (see [`docs/rules.md`](docs/rules.md)).