Core Rule Set: Nextcloud's ordinary requests pass by default (closes #240)

Adds nextcloud.conf, the thirteenth change. Nextcloud's WebDAV paths allow
PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK and UNLOCK. The
account-name cookie nc_username, and the fields that carry a search, a name, a
file name or a folder on the sign-in page, the Files app, public shares and the
OCS API, skip the four rules that read them as commands or system files.
Comments, a share's note, a status and a document's text also skip the rules
that refused ordinary sentences, and the document the two that refused a shell
code block, so "; wget" reaches Nextcloud there. Requests recorded from
Nextcloud 35.0.2, its web pages, sync client 3.16.7 and the OCS API pass at the
defaults and while bodies are read.

Model: opus-5-5

README.md

@@ -581,23 +581,21 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in twelve ways so that ordinary
+- `smallwebwaf` changes the Core Rule Set in thirteen ways so that ordinary
   requests get through to the apps listed below. These requests include git over
   HTTP and sign-in through Git Credential Manager on a code forge, and saving a
-  post from the block editor on WordPress. On gitea's own paths, its searches,
-  file names and branch names get through too. On WordPress's own paths, its
-  searches, names and file names do. On Drupal's own paths, the page to return
-  to, its searches and its names get through too. On MediaWiki's own paths, its
-  searches, page titles, names and wikitext do. On Mastodon's own paths, its
-  searches, names, posts and deliveries from other servers do. No setting undoes
-  the changes; "Attack detection" in [`SPEC.md`](SPEC.md) lists them.
+  post from the block editor on WordPress. No setting undoes the changes;
+  "Attack detection" in [`SPEC.md`](SPEC.md) lists them.
 - These apps work out of the box at the default settings, and their recorded
-  ordinary requests pass the Core Rule Set:
-    - gitea;
-    - WordPress;
-    - Drupal;
-    - MediaWiki;
-    - Mastodon.
+  ordinary requests pass the Core Rule Set. On each app's own paths, these get
+  through too:
+    - gitea: its searches, file names and branch names;
+    - WordPress: its searches, names and file names;
+    - Drupal: the page to return to, its searches and its names;
+    - MediaWiki: its searches, page titles, names and wikitext;
+    - Mastodon: its searches, names, posts and deliveries from other servers;
+    - Nextcloud, with its sync client: its WebDAV methods, searches, file names,
+      account names, comments and documents.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again