Core Rule Set: Ghost's remaining fields pass with words that name commands (closes #359)

Ghost 6.76.0 was sent the fields not yet recorded with python3,
powershell, ls -la and .htaccess. Fixes in ghost.conf:

- eight rules that refused words naming commands and files, 932235 among
  them, for staff profiles, setup, invitations, tiers, offers,
  recommendations, integrations, webhooks, feature images, comments, the
  CSV import's labels, ActivityPub, and source and the utm_ fields;
- 932235 for the existing plain-text fields and code injection;
- filter skips six more rules, for title:~'powershell & python3';
- pathname skips 930120, 932120 and 932260;
- invitation addresses, email_segment, a tag's canonical_url, and
  ActivityPub's handles, actorUri and domain;
- a tag's code injection skips what a post's does.

Model: opus-5-5

README.md

@@ -609,9 +609,9 @@ lowers a client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
     - `nextcloud`, whose fixes let through its sync client, its WebDAV methods,
       its searches, its file names, its account names, its comments and its
       documents;
-    - `ghost`, whose fixes let through its filters, its searches, its names, its
-      email addresses, its code injection, its settings and a post saved from
-      its editor, HTML included.
+    - `ghost`, whose fixes let through the text its admin and members type, its
+      analytics, its code injection, ActivityPub and a post saved from its
+      editor, HTML included.
 - A random password, as a password manager makes one, gets through these forms:
     - signing in, signing up, and changing or resetting a password, on
       WordPress, Drupal, MediaWiki, Mastodon, Nextcloud, gitea and Ghost;