Gitea setup: Core Rule Set blocks attacks, not ordinary Gitea traffic (closes #198)

The Gitea setup runs the Core Rule Set in block mode. Rules that refused
ordinary Gitea requests are switched off only where they misfired:

- deploy/gitea/crs-exclusions.conf, loaded through the new setting
  SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE before the Core Rule Set's rules,
  covers Gitea's search, file-name and branch-name fields, Referer, file
  paths, API attachment names and Actions artifact uploads;
- smallwebwaf's defaults gain a seventh change: the registry upload
  path's from parameter skips 932260.

A file that cannot be read, does not parse or names an id from 900000
to 900999 stops servewaf at start, in every mode. internal/waf's tests
and script/gitea-setup send the recorded requests in
internal/waf/testdata/gitea-requests.txt and three attacks.

Model: opus-5-5

script/gitea-requests

@@ -4,7 +4,8 @@
 # default but these: SWRP_UPSTREAM_URL names gitea's container, SWRP_WAF_BACKEND
 # names servewaf's, and SWWAF_LOG_REQUEST_HEADERS adds the header that labels a
 # request. Then send through rproxy the gitea requests that reading gitea's
-# source found the Core Rule Set refuses, which docs/gitea.md records, and a
+# source found the Core Rule Set refuses without the exclusions in
+# deploy/gitea/crs-exclusions.conf, and a
 # short sample of gitea's ordinary use: signing in, pages of files and commits,
 # a diff, the API, a push, clone and fetch over HTTP, and two container image
 # pushes. Last, print each request servewaf logged, with what it did with it and