Core Rule Set: Forgejo's ordinary requests pass by default (closes #342)

Forgejo 17.0.1's ordinary traffic, recorded in `testdata/forgejo-requests.txt` (pages signed in and out, admin pages, the API with a token, git clone and push, the generic and container registries, uploads), passes at the default settings. What Forgejo sends and gitea does not: its flash cookie `flash` joins the cookies left out, and in the new `forgejo.conf` `q` on its wiki search skips five rules. In `gitea.conf`, the API's package search joins the name searches, and `q` there also skips 932250, except on user and organisation pages. `README.md` lists Forgejo; `SPEC.md` lists the changes.

- Still refused, each tracked: `ls -la` on user and organisation pages; file and branch names in bodies while bodies are read; Forgejo's searches at a branch or tag, of releases and of job logs; other search fields not yet recorded.

Model: opus-5-5

README.md

@@ -581,7 +581,7 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in fourteen ways so that ordinary
+- `smallwebwaf` changes the Core Rule Set in fifteen ways so that ordinary
   requests get through to the apps listed below. No setting undoes the changes;
   "Attack detection" in [`SPEC.md`](SPEC.md) lists them.
 - These apps work out of the box at the default settings, and their recorded
@@ -589,6 +589,9 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
     - gitea: git over HTTP and sign-in through Git Credential Manager get
       through. On gitea's own paths, its searches, file names and branch names
       do too.
+    - Forgejo: git over HTTP and its container and package registries get
+      through. On Forgejo's own paths, its searches, file names and branch names
+      do too.
     - WordPress: saving a post from the block editor gets through. On
       WordPress's own paths, its searches, names and file names do too.
     - Drupal: on Drupal's own paths, the page to return to, its searches and its