Core Rule Set: the API searches gitea and Forgejo share pass (closes #353)

Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on the API's searches of
topics, of an organisation's teams and of emails joins 900603, which skips
930120, 932120, 932250 and 932260. The same four rules are skipped by
query on the search of unadopted repositories (900607) and by name on the
search of a repository's milestones (900608). 900605 also lets /bin/sh
through in q on the API's search of packages, since a package name can
hold a slash. The searches of repositories, users and issues already
passed.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

SPEC.md

@@ -883,11 +883,12 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
         which refused `org.apache.commons.logging`.
 
         A branch, tag or package name can hold a slash, as `feat/docker-support`
-        does. So `q` skips the rule for shell paths (932160) too on these pages,
-        where it refused `/bin/sh`:
+        does. So `q` skips the rule for shell paths (932160) too on these
+        searches, where it refused `/bin/sh`:
         - a repository's branches, tags and packages pages;
         - an owner's packages page;
-        - the admin page of packages.
+        - the admin page of packages;
+        - the API's search of packages.
 
     - `q` on gitea's other searches, for the same four rules. Words such as
       `python3`, `powershell`, `ls -la` and `.htaccess` were refused there. The
@@ -902,12 +903,19 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
         - the runner lists of the site, a user, an organisation and a
           repository;
         - the admin lists of users, organisations, repositories, unadopted
-          repositories and emails.
+          repositories and emails;
+        - the API's searches of topics, of an organisation's teams and of
+          emails.
 
         Most send `q` in the query string. The admin forms that adopt a
         repository or activate an email send it in the body. gitea serves its
         admin pages under `/-/admin/` and Forgejo under `/admin/`.
 
+    - Two fields of the API's searches other than `q`, for the same four rules:
+        - `query` of the search of unadopted repositories, which holds an owner
+          and a name, such as `alice/python3-app`;
+        - `name` of the search of a repository's milestones.
+
     - The path of these requests, which names a file:
         - a file's page;
         - its raw file;