Core Rule Set: Drupal's ordinary requests pass by default (closes #236)

Adds drupal.conf, the ninth change: on Drupal's paths, the fields that
carry a search, a name, a file name or an address skip the rules that
refused ordinary requests there. The recorded requests from Drupal 11.4
pass at the defaults and while bodies are read; SQL injection, path
traversal and script injection stay refused on those fields.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -123,9 +123,9 @@ func atDefaults(t *testing.T) *coreruleset.CoreRuleSet {
 	return newCoreRuleSet(t, 1, defaultDisabledRules...)
 }
 
-// wantChange checks that crs lets through passes, a gitea request one of
-// the eight changes is for, and still finds result in refused, a request
-// like it that the change is not for.
+// wantChange checks that crs lets through passes, a request one of the
+// nine changes is for, and still finds result in refused, a request like
+// it that the change is not for.
 func wantChange(
 	t *testing.T, crs *coreruleset.CoreRuleSet, passes, refused request,
 	result coreruleset.Result,