Core Rule Set: ls -la passes in q on a gitea user's or organisation's page (closes #349)

On a path of one segment, q now skips 932250 too, unless the path ends
in a server-side script's extension, such as .php or .cgi. The searches
on a user's and an organisation's page are recorded from gitea 1.27.3
and Forgejo 17.0.1.

Model: opus-5-5

internal/coreruleset/gitea.conf

@@ -135,8 +135,8 @@ SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
 # The repositories on a user's or an organisation's page are searched with q
-# too. Their path has one segment, as other apps' pages such as /index.php do,
-# so q keeps 932250 there and skips only these rules:
+# too. Their path has one segment, so q skips these rules on every path of one
+# segment, other apps' pages such as /index.php included:
 #   930120: .profile
 #   932120: powershell-scripts
 #   932260: python3-app
@@ -146,6 +146,13 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
+# On those pages q skips 932250 too, which refused ls -la. A path keeps it when
+# it ends in a server-side script's extension, such as /index.php or /search.cgi.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
+    "id:900606,phase:1,pass,nolog,chain"
+    SecRule REQUEST_FILENAME "!@rx \.(?:php|phtml|php5|cgi|pl|py|asp|aspx|jsp)$" \
+        "t:lowercase,ctl:ruleRemoveTargetById=932250;ARGS:q"
+
 # These requests name a file in the path, which skips these rules there:
 #   920500: notes.txt~
 #   934100: process.env.d.ts