Core Rule Set: Drupal's ordinary requests pass by default (closes #236)

Adds drupal.conf, the ninth change: on Drupal's paths, the fields that
carry a search, a name, a file name or an address skip the rules that
refused ordinary requests there. The recorded requests from Drupal 11.4
pass at the defaults and while bodies are read; SQL injection, path
traversal and script injection stay refused on those fields.

Model: opus-5-5

README.md

@@ -581,11 +581,16 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in eight ways so that it lets ordinary
-  requests to a code forge through, such as git over HTTP and sign-in through
-  Git Credential Manager. On gitea's own paths, its searches, file names and
-  branch names get through too. No setting undoes the changes; "Attack
-  detection" in [`SPEC.md`](SPEC.md) lists them.
+- `smallwebwaf` changes the Core Rule Set in nine ways so that ordinary requests
+  get through to a code forge and to Drupal. On a code forge they include git
+  over HTTP and sign-in through Git Credential Manager. On gitea's own paths,
+  its searches, file names and branch names get through too. On Drupal's own
+  paths, its searches, names and return addresses do. No setting undoes the
+  changes; "Attack detection" in [`SPEC.md`](SPEC.md) lists them.
+- These apps work out of the box at the default settings. The Core Rule Set lets
+  through the ordinary requests recorded from each of them:
+    - gitea;
+    - Drupal.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again