Core Rule Set: WordPress's ordinary requests pass by default (closes #235)

Add the ninth change: wordpress.conf switches off, per path and field, each
rule that refused ordinary WordPress 7.1.4 requests. Three groups of fields
skip four rules on system files and commands, and only the addresses of the
first group also skip 932235. Add the recorded requests, a test at the
defaults and reading bodies, and list WordPress in the README.

Model: opus-5-5 (rework); sonnet-5-5 (copied the recorded lines)

internal/coreruleset/coreruleset.go

@@ -1,6 +1,6 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the eight changes sww
+// body while SWW_WAF_BODY_LIMIT is set, with the nine changes sww
 // makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
@@ -32,8 +32,8 @@ import (
 
 // directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, bodyDirectives for the first %s while
-// SWW_WAF_BODY_LIMIT is set, the exclusions file for the second, and
-// giteaExclusions for the third.
+// SWW_WAF_BODY_LIMIT is set, the exclusions file for the second,
+// giteaExclusions for the third, and wordpressExclusions for the fourth.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
@@ -84,6 +84,9 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
 # The eighth change comes before the rules for the same reason.
 %s
 
+# The ninth change comes before the rules for the same reason.
+%s
+
 # The sixth: only the rules for requests are loaded, and no response is
 # inspected.
 Include @owasp_crs/REQUEST-*.conf
@@ -175,6 +178,13 @@ SecRule MULTIPART_STRICT_ERROR "!@eq 0" "id:900450,phase:2,pass,\
 //go:embed gitea.conf
 var giteaExclusions string
 
+// wordpressExclusions are the ninth change: the fields of WordPress's own
+// requests that skip the rules that refused them there, as Coraza
+// directives.
+//
+//go:embed wordpress.conf
+var wordpressExclusions string
+
 // cookiesNotRead are the cookies the Core Rule Set reads a request
 // without, the rest of the fifth change.
 //
@@ -288,7 +298,7 @@ type CoreRuleSet struct {
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the eight changes, at params'
+// New returns the Core Rule Set with the nine changes, at params'
 // paranoia level, without the rules it switches off, reading request
 // bodies up to params' limit, and with params' exclusions file loaded
 // before the Core Rule Set's rules. An exclusions file is an error if it
@@ -316,7 +326,7 @@ func New(params Params) (*CoreRuleSet, error) {
 	}
 
 	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
-		giteaExclusions)
+		giteaExclusions, wordpressExclusions)
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))