Core Rule Set: a repository's name passes in the adopt form's id (closes #365)

While bodies are read, the forms that adopt or delete an unadopted
repository were refused when the repository's name held a command, a
system file's name or a shell path, such as alice/python3-app,
alice/.profile or robin/assets. id there now skips 930120, 932120, 932160
and 932260. The paths are gitea's /-/admin/repos/unadopted, Forgejo's
/admin/repos/unadopted, and /user/settings/repos/unadopted, which both
serve.

Model: opus-5-5

SPEC.md

@@ -826,9 +826,9 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
    with any script removed and returns only to its own pages. Every other cookie
    is read in full.
 3. On gitea's paths, some fields skip the rules that refused ordinary gitea
-   requests there. They are the fields where gitea sends a search, a file name
-   or a branch name. `internal/coreruleset/gitea.conf` lists each rule and the
-   request it refused. The fields are:
+   requests there. They are the fields where gitea sends a search, a file name,
+   a branch name or a repository's name. `internal/coreruleset/gitea.conf` lists
+   each rule and the request it refused. The fields are:
     - `q` on gitea's searches of code, of issues and pull requests, and of
       commits. A code search holds code, such as `<script>`,
       `SELECT * FROM users WHERE` or `../`. The searches of issues and pull
@@ -924,6 +924,15 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
         - to start a release from a tag;
         - to edit a branch protection rule;
         - to list a directory's last commits.
+    - `id` of the forms that adopt or delete an unadopted repository, for the
+      rules that refused repository names (930120, 932120, 932160, 932260). `id`
+      holds the repository's name, such as `python3-app` or `.profile`. The
+      admin forms put the owner in front. There the rule for shell paths refused
+      `robin/assets`, which holds `bin/as`. The forms post to these paths:
+        - `/-/admin/repos/unadopted`, gitea's admin form;
+        - `/admin/repos/unadopted`, Forgejo's admin form;
+        - `/user/settings/repos/unadopted`, the form in a user's settings, on
+          both.
     - The `Content-Range` header of an artifact upload from
       `actions/upload-artifact@v3` (920450).
     - The passwords in a body, for each rule that random passwords set off. The