Core Rule Set: Forgejo's ordinary requests pass by default (closes #342)

Forgejo 17.0.1's ordinary traffic, recorded in `testdata/forgejo-requests.txt` (pages signed in and out, admin pages, the API with a token, git clone and push, the generic and container registries, uploads), passes at the default settings. What Forgejo sends and gitea does not: its flash cookie `flash` joins the cookies left out, and in the new `forgejo.conf` `q` on its wiki search skips five rules. In `gitea.conf`, the API's package search joins the name searches, and `q` there also skips 932250, except on user and organisation pages. `README.md` lists Forgejo; `SPEC.md` lists the changes.

- Still refused, each tracked: `ls -la` on user and organisation pages; file and branch names in bodies while bodies are read; Forgejo's searches at a branch or tag, of releases and of job logs; other search fields not yet recorded.

Model: opus-5-5

internal/coreruleset/recorded_test.go

@@ -149,6 +149,25 @@ func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 	wantRecordedRequestsPass(t, "drupal-requests.txt")
 }
 
+// TestOrdinaryForgejoRequestsPass checks Forgejo's recorded requests at the
+// defaults only. While bodies are read, the Core Rule Set still refuses the
+// file and branch names some of them carry in a form or JSON body, as it does
+// gitea's (TestGiteaBodiesTheCoreRuleSetRefuses).
+func TestOrdinaryForgejoRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := atDefaults(t)
+
+	for _, recorded := range recordedRequests(t, "forgejo-requests.txt") {
+		r := request{recorded.Method, recorded.Target, recorded.Headers}
+		if got, _ := inspectBody(t, crs, r, recorded.Body); got.Score >= threshold {
+			t.Errorf("%s %s refused: %+v", r.method, r.target, got)
+		}
+	}
+}
+
 func TestOrdinaryMastodonRequestsPass(t *testing.T) {
 	t.Parallel()