Core Rule Set: random passwords pass at sign-in (closes #276)

A password manager's random password set off 35 Core Rule Set rules,
about 1 in 40 refused. The password fields the app exclusions name now
skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki
wpPassword, lgpassword and password, Mastodon's sign-in, sign-up,
password change, move and delete passwords, and Nextcloud's sign-in
password. The tests draw 2,000 random passwords from a fixed seed, plus
one rare password for each rule the 2,000 do not set off. Those that set
off a rule in a field no exclusion names are sent to every password
field. `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and
`<img src=x onerror=x()>` sent as a password now pass;
`<script>alert(1)</script>` and `javascript:alert(1)` are still refused.

Model: opus-5-5

internal/coreruleset/drupal.conf

@@ -184,6 +184,46 @@ SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/user/login$" \
         ctl:ruleRemoveTargetById=932250;ARGS:/^(?:json\.)?(?:name|pass)$/,\
         ctl:ruleRemoveTargetById=932260;ARGS:/^(?:json\.)?(?:name|pass)$/"
 
+# The password, pass, skips each rule that random passwords set off.
+SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/user/login$" \
+    "id:900819,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:json\.)?pass$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=920270;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=920540;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=921200;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=930100;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=930110;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=930120;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=932125;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=932130;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=932160;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=932230;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=932250;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=932260;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=932270;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=932280;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=932330;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=932340;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=932370;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=932380;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=933100;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=933135;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=933180;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=933210;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=941100;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=941120;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=941160;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=941180;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=942100;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=942151;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=942190;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=942230;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=942290;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=942320;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=942540;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=942550;ARGS:/^(?:json\.)?pass$/,\
+        ctl:ruleRemoveTargetById=944150;ARGS:/^(?:json\.)?pass$/"
+
 # A person's name and email address, when signing up, when editing an
 # account and when commenting without an account. A name of python3 refused
 # signing up, and python3@example.com refused saving an account. An address