Core Rule Set: Forgejo's ordinary requests pass by default (closes #342)

Forgejo 17.0.1's ordinary traffic, recorded in `testdata/forgejo-requests.txt` (pages signed in and out, admin pages, the API with a token, git clone and push, the generic and container registries, uploads), passes at the default settings. What Forgejo sends and gitea does not: its flash cookie `flash` joins the cookies left out, and in the new `forgejo.conf` `q` on its wiki search skips five rules. In `gitea.conf`, the API's package search joins the name searches, and `q` there also skips 932250, except on user and organisation pages. `README.md` lists Forgejo; `SPEC.md` lists the changes.

- Still refused, each tracked: `ls -la` on user and organisation pages; file and branch names in bodies while bodies are read; Forgejo's searches at a branch or tag, of releases and of job logs; other search fields not yet recorded.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -204,7 +204,7 @@ func atDefaults(t *testing.T) *coreruleset.CoreRuleSet {
 }
 
 // wantChange checks that crs lets through passes, a request one of the
-// fourteen changes is for, and still finds result in refused, a request like
+// fifteen changes is for, and still finds result in refused, a request like
 // it that the change is not for.
 func wantChange(
 	t *testing.T, crs *coreruleset.CoreRuleSet, passes, refused request,
@@ -370,7 +370,7 @@ func TestParameterNamesAreMatchedWithoutRegardToCase(t *testing.T) {
 		get("/?next=http://127.0.0.1:52341/"), matched(931100, 934110))
 }
 
-func TestCookiesGiteaFlashAndRedirectToAreNotRead(t *testing.T) {
+func TestFlashAndRedirectToCookiesAreNotRead(t *testing.T) {
 	t.Parallel()
 
 	const (
@@ -380,8 +380,12 @@ func TestCookiesGiteaFlashAndRedirectToAreNotRead(t *testing.T) {
 
 	crs := atDefaults(t)
 
-	wantChange(t, crs, get("/owner/repo", "Cookie: gitea_flash="+flash),
-		get("/owner/repo", "Cookie: flash="+flash), matched(930120))
+	// flash is Forgejo's name for gitea_flash.
+	for _, name := range []string{"gitea_flash", "flash"} {
+		wantChange(t, crs, get("/owner/repo", "Cookie: "+name+"="+flash),
+			get("/owner/repo", "Cookie: message="+flash), matched(930120))
+	}
+
 	wantChange(t, crs, get("/", "Cookie: redirect_to="+redirectTo),
 		get("/", "Cookie: redirect="+redirectTo), matched(930120))