Core Rule Set: Nextcloud's ordinary requests pass by default (closes #240)

Adds nextcloud.conf, the thirteenth change. Nextcloud's WebDAV paths allow
PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK and UNLOCK, and
the body of a PUT there, an uploaded file, is not read. The cookie
nc_username, and the fields that carry a search, a name, a file name or a
folder, skip the four rules that read them as commands or system files.
Comments, a share's note, a status and a document's text also skip the rules
that refused ordinary sentences, and the document the two that refused a
shell code block. Requests recorded from Nextcloud 35.0.2, its web pages, sync
client 3.16.7 and the OCS API pass at the defaults and while bodies are read.

Model: opus-5-5

internal/coreruleset/mediawiki_test.go

@@ -167,7 +167,7 @@ var mediawikiBodyFields = []mediawikiBodyField{
 	{mediawikiAPI, "lgname="},
 	{mediawikiAPI, "lgpassword="},
 	{mediawikiAPI, "username="},
-	{mediawikiAPI, "password="},
+	{mediawikiAPI, passwordField},
 }
 
 // mediawikiReasonFields are the reasons on the admin pages, which skip only