Core Rule Set: random passwords pass on the multisite network profile page (closes #300)

/wp-admin/network/profile.php posts pass1 and pass2 to itself. The
exclusion that lets them skip the random-password rules on WordPress's
other profile pages now names it too.

Model: opus-5-5

SPEC.md

@@ -960,8 +960,8 @@ The changes hold in front of every app, and no setting undoes them:
             - `/wp-admin/profile.php`;
             - `/wp-admin/user-edit.php`;
             - `/wp-admin/user-new.php`;
-            - `/wp-admin/network/user-edit.php` and
-              `/wp-admin/user/profile.php`, on a multisite install.
+            - `/wp-admin/network/user-edit.php`, `/wp-admin/network/profile.php`
+              and `/wp-admin/user/profile.php`, on a multisite install.
 
             Each of `pass1`, `pass2` and `post_password` skips these rules on
             all of these pages and on `/wp-login.php`.

internal/coreruleset/coreruleset_test.go

@@ -1646,6 +1646,7 @@ func TestWordPressPasswordFieldsPass(t *testing.T) {
 		{"/wp-admin/user-edit.php?user_id=2", formData, pass},
 		{"/wp-admin/user-new.php", formData, pass},
 		{"/wp-admin/network/user-edit.php?user_id=2", formData, pass},
+		{"/wp-admin/network/profile.php", formData, pass},
 		{"/wp-admin/user/profile.php", formData, pass},
 		{"/wp-json/wp/v2/users", jsonBody, []string{passwordKey}},
 		{"/wp-json/wp/v2/users/me", formData, []string{passwordKey}},

internal/coreruleset/wordpress.conf

@@ -139,10 +139,10 @@ SecRule REQUEST_FILENAME "@streq /wp-login.php" \
 # The other passwords, which skip the same rules:
 #   pass1, pass2: resetting the password at /wp-login.php, changing it on the
 #   profile page and the page that edits a user, and adding a user; a
-#   multisite install also changes it on network/user-edit.php and
-#   user/profile.php
+#   multisite install also changes it on network/user-edit.php,
+#   network/profile.php and user/profile.php
 #   post_password: the password of a protected post, sent to /wp-login.php
-SecRule REQUEST_FILENAME "@rx ^/(?:wp-login\.php|wp-admin/(?:profile|user-edit|user-new|network/user-edit|user/profile)\.php)$" \
+SecRule REQUEST_FILENAME "@rx ^/(?:wp-login\.php|wp-admin/(?:profile|user-edit|user-new|network/user-edit|network/profile|user/profile)\.php)$" \
     "id:900715,phase:1,pass,nolog,chain"
     SecRule &ARGS_GET:/^(?:pass[12]|post_password)$/ "@eq 0" \
         "ctl:ruleRemoveTargetById=920270;ARGS:/^(?:pass[12]|post_password)$/,\