Core Rule Set: MediaWiki's password fields pass on a wiki in any language (closes #299)

A wiki in another language posts its sign-up, password change and
new-password forms to its own names for the special pages, such as
Spezial:Benutzerkonto_anlegen. So password and retype no longer match on
the English page name. They skip the rules when authAction names the
form that sends them: change, create or login-continue. MediaWiki sends
the same value in every language. The page must still be MediaWiki's,
with a namespace in its title, so another app's paths under /index.php/
keep every rule. The two rules move to phase 2 to read the body.

Adds requests recorded from a German MediaWiki 1.46.2.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -943,16 +943,18 @@ func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
 	crs := readingBodies(t)
 
 	// These fields skip the rules only when the query has no field of the
-	// same name. An SQL injection in the query is refused.
+	// same name. An SQL injection in the query is refused. MediaWiki's
+	// password and retype skip them only when authAction names their form,
+	// so its rows send that before the field.
 	for _, sent := range []struct{ path, field string }{
 		{nextcloudSignIn, passwordField},
 		{mediawikiAPI, passwordField},
 		{mediawikiAPI, "lgpassword="},
 		{mediawikiAPI, retypeKey + "="},
-		{mediawikiAccountChange, passwordField},
-		{mediawikiAccountChange, retypeKey + "="},
-		{mediawikiSignUp, retypeKey + "="},
-		{"/wiki/Special:UserLogin", retypeKey + "="},
+		{mediawikiAccountChange, "authAction=change&" + passwordField},
+		{mediawikiAccountChange, "authAction=change&" + retypeKey + "="},
+		{mediawikiSignUp, "authAction=create&" + retypeKey + "="},
+		{"/wiki/Special:UserLogin", "authAction=login-continue&" + retypeKey + "="},
 		{"/user/sign_up", passwordField},
 		{"/user/settings/account", "old_password="},
 		{wpLogin, "pass1="},