Core Rule Set: Forgejo's searches at a branch or tag, of releases and of job logs pass (closes #350)

`testdata/forgejo-requests.txt` records these Forgejo 17.0.1 searches with the hard values, file names and plain words, and the code search with code and a page opened from each search. `forgejo.conf` lets them through:

- the code search at a branch or tag, where the home page's search box sends its search without a code indexer: `q` skips what it skips on gitea's code search, and `Referer` what it skips after gitea's searches;
- the release search, page and API: `q` skips 930120, 932120, 932160, 932250 and 932260, since it matches tag names;
- the job log search in the API: the same, without 932160.

In `gitea.conf`, `q` on a repository's branches page and an owner's packages page also skips 932160, so `/bin/sh` passes there. `SPEC.md` lists both.

Model: opus-5-5

SPEC.md

@@ -801,8 +801,9 @@ The changes hold in front of every app, and no setting undoes them:
         - a file named `java.lang.String.md`.
 
         Every request from such a page would be refused. `Referer` keeps the
-        other rules, except after some gitea searches (the eighth change). An
-        app that passes `Referer` to a shell must check it itself.
+        other rules, except after some searches of gitea and Forgejo (the eighth
+        and fifteenth changes). An app that passes `Referer` to a shell must
+        check it itself.
 
 6. Responses are not inspected. A raw file from a repository, such as a shell
    script, looks to the response rules like source code leaking from the server.
@@ -849,6 +850,11 @@ The changes hold in front of every app, and no setting undoes them:
         Some of these searches also skip the rule for Java class names (944130),
         which refused `org.apache.commons.logging`.
 
+        A branch or package name can hold a slash, as `feat/docker-support`
+        does. So `q` on a repository's branches page and on an owner's packages
+        page also skips the rule for shell paths (932160), which refused
+        `/bin/sh`.
+
     - The path of these requests, which names a file:
         - a file's page;
         - its raw file;
@@ -1583,21 +1589,40 @@ The changes hold in front of every app, and no setting undoes them:
     `/index.php/`. Elsewhere these fields keep every rule. An app other than
     Nextcloud that serves one of these paths must check these fields itself.
 
-15. On Forgejo's paths, `q` on the search of a wiki skips the rules that refused
+15. On Forgejo's paths, `q` on some of its searches skips the rules that refused
     ordinary Forgejo searches there. Forgejo is a fork of gitea, and the eighth
     change applies to its requests too. This change holds only what Forgejo
     sends and gitea does not. `internal/coreruleset/forgejo.conf` lists each
-    rule and the search it refused:
+    rule and the search it refused. The searches are:
+    - the search of a wiki, on `/<owner>/<repo>/wiki/search`;
+    - the search of a repository's releases, on `/<owner>/<repo>/releases` and
+      `/api/v1/repos/<owner>/<repo>/releases`;
+    - the search of a job's log, on
+      `/api/v1/repos/<owner>/<repo>/actions/jobs/<id>/logs`.
+
+    There `q` skips these rules:
     - system files (930120), such as `.htaccess`;
     - Windows commands (932120), such as `powershell`;
-    - shell paths (932160), such as `/bin/sh`;
+    - shell paths (932160), such as `/bin/sh`, except on the search of a job's
+      log;
     - Unix commands (932250), such as `ls -la`;
     - command names (932260), such as `python3`.
 
     `; wget http://example.com/x.sh`, path traversal, and SQL and script
-    injection are still refused there. The path is `/<owner>/<repo>/wiki/search`
-    at the site root. An app other than Forgejo that serves such a path must
-    check `q` itself.
+    injection are still refused there.
+
+    The search of a repository's code at a branch or a tag is on
+    `/<owner>/<repo>/search/branch/<branch>` and
+    `/<owner>/<repo>/search/tag/<tag>`. The search box on a repository's home
+    page sends its search there when Forgejo has no code indexer, as by default.
+    There `q` skips the rules it skips on gitea's search of code in the eighth
+    change. So code, such as `<script>` or `SELECT * FROM users WHERE`, reaches
+    Forgejo in `q` there. `Referer` of a page opened from such a search skips
+    the rules for script and SQL injection and Java code, as after gitea's
+    searches (941110, 941120, 941160, 942100, 944100).
+
+    These paths are matched at the site root. An app other than Forgejo that
+    serves one of them must check `q` and `Referer` itself.
 
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.