Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237)

Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields
that carry a search, a title, a name, a file name or an address skip the
four rules that read them as commands or system files, and the wikitext
fields skip the rules that refused saving a page. /index.php counts as
MediaWiki's only with a page title in its query or after its path, since
WordPress serves it too. The requests recorded from MediaWiki 1.46.2, with
and without short URLs, pass at the defaults and while bodies are read. The
app tests share the check of recorded requests and the list of hard values.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -127,7 +127,7 @@ func atDefaults(t *testing.T) *coreruleset.CoreRuleSet {
 }
 
 // wantChange checks that crs lets through passes, a request one of the
-// ten changes is for, and still finds result in refused, a request like
+// eleven changes is for, and still finds result in refused, a request like
 // it that the change is not for.
 func wantChange(
 	t *testing.T, crs *coreruleset.CoreRuleSet, passes, refused request,
@@ -537,6 +537,38 @@ const (
 	scriptInjection = "%3Cscript%3Ealert(1)%3C%2Fscript%3E"
 )
 
+// hardValues are words that name commands and files, as a query or form
+// value. An app's tests check that its fields let them through.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var hardValues = []string{"python3", "powershell", "ls%20-la", ".htaccess"}
+
+// wantRecordedRequestsPass checks that none of the recorded ordinary
+// requests in the file name in testdata is refused, at the defaults and
+// while bodies are read.
+func wantRecordedRequestsPass(t *testing.T, name string) {
+	t.Helper()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	defaults, bodies := atDefaults(t), readingBodies(t)
+
+	for _, recorded := range recordedRequests(t, name) {
+		r := request{recorded.Method, recorded.Target, recorded.Headers}
+
+		got, _ := inspectBody(t, defaults, r, recorded.Body)
+		if got.Score >= threshold {
+			t.Errorf("%s %s refused: %+v", r.method, r.target, got)
+		}
+
+		got, _ = inspectBody(t, bodies, r, recorded.Body)
+		if got.Score >= threshold {
+			t.Errorf("%s %s %.200q refused while bodies are read: %+v",
+				r.method, r.target, recorded.Body, got)
+		}
+	}
+}
+
 func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 	t.Parallel()