Core Rule Set tests: name repeated attack strings (closes #263)

The Drupal and MediaWiki tests repeated the SQL and script attack strings,
which goconst reports. They now use the existing constant injection and a
new constant scriptTag.

Model: opus-5-5

internal/coreruleset/mediawiki_test.go

@@ -204,8 +204,8 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 	}
 
 	for _, attack := range []string{
-		`1' OR '1'='1`,
-		`<script>alert(1)</script>`,
+		injection,
+		scriptTag,
 	} {
 		for _, field := range []string{"source", "comment"} {
 			r := request{http.MethodPut, mediawikiRESTPage, []string{jsonBody}}