SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

Each app's fixes are one .conf file and one entry in apps. They apply
only while Inspect has set the app's transaction variable, such as
tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only
its apps' fixes; while SWW_APPS is unset, every hostname gets every
app's fixes. Listing forgejo, a fork of gitea, brings gitea's fixes too.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

internal/coreruleset/vaultwarden_test.go

@@ -9,6 +9,8 @@ import (
 	"slices"
 	"strings"
 	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
 // vaultwardenThreshold is SWW_WAF_ANOMALY_THRESHOLD's default.
@@ -29,6 +31,23 @@ const (
 // vaultwardenEmail is a JSON body that sends an address in email.
 const vaultwardenEmail = `{"email":"VALUE"}`
 
+func TestVaultwardenFixesApplyOnlyToAHostnameThatServesVaultwarden(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	crs := servingApps(t, map[string][]string{
+		giteaHost: {gitea}, otherHost: {"vaultwarden"},
+	})
+
+	// An address for the data breach report, which only Vaultwarden's fixes
+	// let through.
+	report := get(vaultwardenBreachReport + "python3%40example.com")
+
+	wantResult(t, crs, withHost(report, otherHost), coreruleset.Result{})
+	wantResult(t, crs, withHost(report, giteaHost), matched(932260))
+}
+
 // vaultwardenField is a field Vaultwarden receives in plain text: the
 // request that sends it, and its body, with VALUE where the field's value
 // goes.