Core Rule Set: Vaultwarden's ordinary requests pass by default (closes #239)

Adds vaultwarden.conf, the thirteenth change, with rule ids 900150 to
900153. On Vaultwarden's account, organization and admin paths, names and
password hints skip 930120, 932120, 932250 and 932260, and so does a
security key's name. Email addresses skip 932120 and 932260 there, on the
two-factor email paths and when signing in with another device. The data
breach report's address does too. The encrypted names of uploaded
attachments and file sends skip 920120. Requests recorded from
Vaultwarden 1.37.5 through the web vault, the Bitwarden command line
client and the admin page pass at the defaults and while bodies are read.

Model: opus-5-5

SPEC.md

@@ -81,8 +81,8 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/coreruleset`: the Core Rule Set, with the twelve changes listed
-      under "Attack detection", as Coraza directives.
+    - `internal/coreruleset`: the Core Rule Set, with the thirteen changes
+      listed under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
     - `internal/reputation`: fetches the lists, asks the DNS blocklists and
@@ -676,8 +676,8 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions. The eighth to twelfth changes below hold those
-  of the apps they name.
+  holds an app's own exclusions. The eighth to thirteenth changes below hold
+  those of the apps they name.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
       `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
@@ -723,14 +723,15 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in twelve ways. Without them, it
-would refuse ordinary requests to these apps:
+`smallwebwaf` changes the Core Rule Set 4.25.0 in thirteen ways. Without them,
+it would refuse ordinary requests to these apps:
 
 - gitea;
 - WordPress;
 - Drupal;
 - MediaWiki;
-- Mastodon.
+- Mastodon;
+- Vaultwarden.
 
 The changes hold in front of every app, and no setting undoes them:
 
@@ -762,10 +763,11 @@ The changes hold in front of every app, and no setting undoes them:
     or `docker-build`. In these parameters, what only these three rules would
     catch reaches the app, such as the command `|cat /etc/passwd`. Path
     traversal, SQL and script injection, and PHP, Java and Node.js code are
-    still refused there. Other parameters keep all three rules, except on the
-    apps' own paths that the eighth to twelfth changes name. An app that uses
-    one of these parameters as a file on the server, or passes it to a shell,
-    must check the value itself. A rule file can refuse it instead.
+    still refused there. Other parameters keep all three rules. The eighth to
+    thirteenth changes switch some of them off for some fields on the paths of
+    gitea, WordPress, Drupal, MediaWiki, Mastodon and Vaultwarden. An app that
+    uses one of these parameters as a file on the server, or passes it to a
+    shell, must check the value itself. A rule file can refuse it instead.
 
 5. Two cookies are left out, and `Referer` keeps fewer rules:
     - The Core Rule Set reads the request without the `gitea_flash` and
@@ -1203,6 +1205,62 @@ The changes hold in front of every app, and no setting undoes them:
     every rule. An app other than Mastodon that serves one of these paths must
     check these fields itself.
 
+13. On Vaultwarden's paths, some fields skip the rules that refused ordinary
+    Vaultwarden requests there. `internal/coreruleset/vaultwarden.conf` lists
+    each rule and the request it refused. The apps encrypt vault items, folders,
+    collections and sends before sending them, so those fields skip no rules.
+    The fields below hold plain text.
+
+    Names and password hints skip the lists of system files and command names
+    (930120, 932120, 932250, 932260):
+    - `name`, the name of the account, an organization, a group or a security
+      key;
+    - `masterPasswordHint`, when signing up or changing the master password;
+    - `invitation_org_name` and `smtp_from_name`, on the admin page's settings.
+
+    These fields hold email addresses and skip only 932120 and 932260:
+    - `username`, when signing in at `/identity/connect/token`;
+    - `email`, `newEmail`, `billingEmail` and the invited `emails`;
+    - the salt fields, such as `masterPasswordUnlock.salt`, which hold the
+      address;
+    - `smtp_from`, on the admin page's settings.
+
+    So `python3@example.com` and `powershell@example.com` pass.
+
+    These fields skip the rules on these paths:
+    - the paths under `/identity/accounts/`;
+    - `/api/accounts/`, `/api/emergency-access/` and `/api/organizations`, and
+      the paths under them;
+    - `/admin/config`.
+
+    Names and password hints skip them on `/api/two-factor/webauthn` too, where
+    a security key gets its name.
+
+    The addresses skip them on these paths too:
+    - `/identity/connect/token` and `/admin/invite`;
+    - the paths under `/api/two-factor/`, where sign-in codes by email are set
+      up and sent;
+    - `/api/auth-requests` and the paths under it, for signing in with another
+      device.
+
+    These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
+    applies when the query has a parameter of the same name.
+
+    `username` in the query of `/api/hibp/breach`, the data breach report, skips
+    932120 and 932260 too.
+
+    The names of uploaded files skip 920120 on the paths that take attachments
+    and file sends:
+    - `/api/ciphers/<id>/attachment` and the paths under it;
+    - `/api/ciphers/<id>/attachment-admin`;
+    - `/api/sends/<id>/file/<file id>`.
+
+    The apps name such a file by its encrypted name, which holds `=`. Path
+    traversal and PHP scripts in the names are still refused.
+
+    Elsewhere these fields keep every rule. An app other than Vaultwarden that
+    serves one of these paths must check these fields itself.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.