Core Rule Set: ls -la passes in q on a gitea user's or organisation's page (closes #349)

On a path of one segment made of the characters a user's or an
organisation's name may hold, q now skips 932250 too, unless the path
ends in a server-side script's extension, such as .php or .cgi. The
searches on a user's and an organisation's page are recorded from gitea
1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

internal/coreruleset/gitea.conf

@@ -135,8 +135,8 @@ SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
 # The repositories on a user's or an organisation's page are searched with q
-# too. Their path has one segment, as other apps' pages such as /index.php do,
-# so q keeps 932250 there and skips only these rules:
+# too. Their path has one segment, so q skips these rules on every path of one
+# segment, other apps' pages such as /index.php included:
 #   930120: .profile
 #   932120: powershell-scripts
 #   932260: python3-app
@@ -146,6 +146,16 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
+# On those pages q skips 932250 too, which refused ls -la, but only on a path
+# made of the characters a user's or an organisation's name may hold. Those are
+# letters, digits, -, _ and dots, the first a letter or digit, so
+# /login.jsp;jsessionid=abc keeps 932250. A path that ends in a server-side
+# script's extension keeps it too, such as /index.php or /search.cgi.
+SecRule REQUEST_FILENAME "@rx ^/[0-9A-Za-z][-.\w]*$" \
+    "id:900606,phase:1,pass,nolog,chain"
+    SecRule REQUEST_FILENAME "!@rx \.(?:php|phtml|php5|cgi|pl|py|asp|aspx|jsp)$" \
+        "t:lowercase,ctl:ruleRemoveTargetById=932250;ARGS:q"
+
 # These requests name a file in the path, which skips these rules there:
 #   920500: notes.txt~
 #   934100: process.env.d.ts