Core Rule Set: Drupal's ordinary requests pass by default (closes #236)

Adds drupal.conf, the ninth change: on Drupal's paths, the fields that
carry a search, a name, a file name or an address skip the rules that
refused ordinary requests there. The recorded requests from Drupal 11.4
pass at the defaults and while bodies are read; SQL injection, path
traversal and script injection stay refused on those fields.

Model: opus-5-5

SPEC.md

@@ -81,7 +81,7 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/coreruleset`: the Core Rule Set, with the eight changes listed
+    - `internal/coreruleset`: the Core Rule Set, with the nine changes listed
       under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
@@ -674,7 +674,8 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions; the eighth change below holds gitea's.
+  holds an app's own exclusions; the eighth and ninth changes below hold gitea's
+  and Drupal's.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
       `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
@@ -720,9 +721,9 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in eight ways, since in front of
-gitea it would otherwise refuse ordinary requests. The changes hold in front of
-every app, and no setting undoes them:
+`smallwebwaf` changes the Core Rule Set 4.25.0 in nine ways, since in front of
+gitea and Drupal it would otherwise refuse ordinary requests. The changes hold
+in front of every app, and no setting undoes them:
 
 1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
    and `OPTIONS`. APIs, container image pushes and package uploads use them.
@@ -753,9 +754,9 @@ every app, and no setting undoes them:
     catch reaches the app, such as the command `|cat /etc/passwd`. Path
     traversal, SQL and script injection, and PHP, Java and Node.js code are
     still refused there. Other parameters keep all three rules, except on the
-    gitea paths the eighth change names. An app that uses one of these
-    parameters as a file on the server, or passes it to a shell, must check the
-    value itself. A rule file can refuse it instead.
+    gitea and Drupal paths the eighth and ninth changes name. An app that uses
+    one of these parameters as a file on the server, or passes it to a shell,
+    must check the value itself. A rule file can refuse it instead.
 
 5. Two cookies are left out, and `Referer` keeps fewer rules:
     - The Core Rule Set reads the request without the `gitea_flash` and
@@ -847,6 +848,38 @@ every app, and no setting undoes them:
     site root. An app other than gitea that serves one of them must check these
     fields itself.
 
+9. On Drupal's paths, some fields skip the rules that refused ordinary Drupal
+   requests there. `internal/coreruleset/drupal.conf` lists each rule and the
+   request it refused. These query fields skip the lists of system files and
+   command names (930120, 932120, 932250, 932260):
+    - On every page under `/admin`: `title`, `name`, `user`, `filename`,
+      `filemime`, `info`, `subject`, `author_name`, `search`, `q` and
+      `destination`.
+    - `destination` on the pages Drupal links to with one, such as
+      `/node/1/edit`, `/user/login` and `/user/logout`.
+    - `keys` on `/search` and the pages under it.
+    - `q` on `/entity_reference_autocomplete/`.
+    - Every `filter[...]` field on `/jsonapi/`.
+
+    `destination` also skips 932230 and 932235, because it holds the address of
+    a page of results.
+
+    These fields of a body skip the rules that refused them. Each applies only
+    when the query has no parameter of that name, so it matters only while
+    `SWW_WAF_BODY_LIMIT` is set:
+    - The title, summary, tags, address, revision note, comment subject, media
+      name and image text on the node, comment and media forms, for 930120,
+      932120, 932250 and 932260.
+    - `title`, `subject` and `body.summary` through JSON:API, for the same four
+      rules.
+    - The body and comment body on those forms and through JSON:API, which hold
+      HTML and any code it shows.
+    - `pass` when signing in (930120, 932120, 932250, 932260).
+
+    Elsewhere these fields keep every rule. The paths are those of Drupal at the
+    site root. An app other than Drupal that serves one of them must check these
+    fields itself.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.