Core Rule Set: the API searches gitea and Forgejo share pass (closes #353)

Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on the API's searches of
topics, of an organisation's teams and of emails joins 900603, which skips
930120, 932120, 932250 and 932260. The same four rules are skipped by
query on the search of unadopted repositories (900607) and by name on the
search of a repository's milestones (900608). 900605 also lets /bin/sh
through in q on the API's search of packages, since a package name can
hold a slash. The searches of repositories, users and issues already
passed.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

internal/coreruleset/coreruleset_test.go

@@ -919,6 +919,10 @@ const retypeKey = "retype"
 // system files (930120) holds.
 const htaccess = ".htaccess"
 
+// binSh is the shell path /bin/sh as a query or form value, which the rule for
+// shell paths (932160) refuses.
+const binSh = "%2Fbin%2Fsh"
+
 // hardValues are words that name commands and files, as a query or form
 // value. An app's tests check that its fields let them through.
 //