Core Rule Set tests: only the concurrency test runs with the race detector (closes #306)

The race pass runs TestConcurrentRequestsKeepTheirOwnExclusions alone of
internal/coreruleset's tests; every other test of the package moves to the
pass that runs the recorded requests, without the race detector. Other
packages run under -race as before. The 90-second limit stays.

Model: opus-5-5

README.md

@@ -702,8 +702,12 @@ on the host.
 - `script/projectname`: prints `smallwebwaf`, which the other scripts tag their
   images with.
 - `script/test`: checks that `go.mod` and `go.sum` are tidy, then runs the
-  tests, as the `test` phase of the `Dockerfile`. It runs them twice: once with
-  the race detector, and once without it for the recorded requests. `make test`.
+  tests, as the `test` phase of the `Dockerfile`, in two passes. `make test`.
+    - The first runs every package's tests with the race detector. Of the Core
+      Rule Set's tests, it runs only the one that inspects requests from several
+      goroutines at once.
+    - The second runs the Core Rule Set's other tests without the race detector,
+      the recorded requests among them.
 - `script/tidy`: writes `go.mod` and `go.sum` as `go mod tidy` writes them, in
   the `tidy` stage of the `Dockerfile`. `make tidy`.
 - `script/lint`: runs golangci-lint, as the `lint` phase of the `Dockerfile`.