Gitea setup: Core Rule Set blocks attacks, not ordinary Gitea traffic (closes #198)

The Gitea setup runs the Core Rule Set in block mode. Rules that refused
ordinary Gitea requests are switched off only where they misfired:

- deploy/gitea/crs-exclusions.conf, loaded through the new setting
  SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE, covers Gitea's search, file-name
  and branch-name fields, Referer, and file paths;
- smallwebwaf's defaults gain a seventh change: the registry upload
  path's from parameter skips 932260.

A file that cannot be read, does not parse or names an id from 900000
to 900999 stops servewaf at start. internal/waf's tests and
script/gitea-setup send the recorded requests in
internal/waf/testdata/gitea-requests.txt and three attacks.

Model: opus-5-5

docs/settings.md

@@ -192,6 +192,10 @@ chooses between the two (see "The image's command" below).
   the Core Rule Set reads, a size of at most `64K`. A question carries no more
   of a body than 64 KiB, and the Core Rule Set reads at most 64 KiB less one
   byte of it, whatever the value (see "The answer" in [`SPEC.md`](../SPEC.md)).
+- `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE` (default unset): a file of Core Rule Set
+  exclusions, written as Coraza directives, loaded after the Core Rule Set. A
+  file that cannot be read or does not parse stops the start. So does a file
+  that names any number from 900000 to 900999. It has no `_FILE` form.
 - `SWWAF_ERROR_BURST_THRESHOLD` (default `30`): the most refusals of one client
   in a minute (see "Attack detection" in `SPEC.md`). A count or `off`.