Core Rule Set: gitea's ordinary requests pass by default (closes #198)

The eighth change, internal/waf/gitea.conf, has some fields skip the
rules that refused ordinary gitea requests there, on gitea's paths only:
searches, file names and branch names. Referer skips 944130 too. A
registry's layer reuse skips 932260 on from, the seventh change.

The new setting SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE loads an operator's
own exclusions before the Core Rule Set's rules. The start stops, in
every mode, on a set file that cannot be read or does not parse, names
smallwebwaf's own ids, or holds a directive such as SecRuleRemoveById.

A test sends the recorded gitea requests at the defaults, none refused,
and three attacks, all refused.

Model: opus-5-5

internal/servewaf/proxy_test.go

@@ -463,6 +463,11 @@ func newServeWAFWith(
 		}
 	}
 
+	coreRuleSet, err := servewaf.NewCoreRuleSet(cfg)
+	if err != nil {
+		t.Fatalf("Core Rule Set: %v", err)
+	}
+
 	server := build(servewaf.Params{
 		Config:       cfg,
 		RequestLog:   out,
@@ -470,6 +475,7 @@ func newServeWAFWith(
 		GeoJSURL:     geojsURL,
 		AbuseIPDBURL: abuseIPDBURL,
 		LookupFile:   lookupFile,
+		CoreRuleSet:  coreRuleSet,
 		Now:          now,
 		Rules:        ruleFiles,
 		Alerts:       alertQueue,