Core Rule Set: random passwords pass at sign-in (closes #276)

A password manager's random password set off 35 Core Rule Set rules,
about 1 in 40 refused. The password fields the app exclusions name now
skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki
wpPassword, lgpassword and password, Mastodon's sign-in, sign-up,
password change, move and delete passwords, and Nextcloud's sign-in
password. Each field's test sends 2,000 random passwords from a fixed
seed, plus one rare password for each rule the 2,000 do not set off.
An SQL injection or a path traversal sent as a password now passes; a
script injection is still refused.

Model: opus-5-5

SPEC.md

@@ -919,7 +919,14 @@ The changes hold in front of every app, and no setting undoes them:
         - `content` of a reply to a comment sent to `admin-ajax.php`.
         - `newcontent` of a plugin's or a theme's file saved from its editor,
           which is PHP.
-        - `pwd` when signing in, for the list of system files (930120).
+        - `pwd`, the password when signing in, for each rule that random
+          passwords set off (920270, 920540, 921200, 930100, 930110, 930120,
+          932125, 932130, 932160, 932230, 932250, 932260, 932270, 932280,
+          932330, 932340, 932370, 932380, 933100, 933135, 933180, 933210,
+          941100, 941120, 941160, 941180, 942100, 942151, 942190, 942230,
+          942290, 942320, 942540, 942550, 944150). An SQL injection or a path
+          traversal sent as the password reaches WordPress. A script injection
+          is still refused.
         - `title`, `excerpt` and `name` in a JSON body sent to any REST API
           route under `/wp/v2/`, for the rules on system files and commands
           (930120, 932120, 932250, 932260).
@@ -987,6 +994,13 @@ The changes hold in front of every app, and no setting undoes them:
     - The body and comment body on the node and comment forms and through
       JSON:API, which hold HTML and any code it shows.
     - `name` and `pass` when signing in (930120, 932120, 932250, 932260).
+    - `pass`, the password when signing in, in form data or JSON, for each rule
+      that random passwords set off (920270, 920540, 921200, 930100, 930110,
+      930120, 932125, 932130, 932160, 932230, 932250, 932260, 932270, 932280,
+      932330, 932340, 932370, 932380, 933100, 933135, 933180, 933210, 941100,
+      941120, 941160, 941180, 942100, 942151, 942190, 942230, 942290, 942320,
+      942540, 942550, 944150). An SQL injection or a path traversal sent as the
+      password reaches Drupal. A script injection is still refused.
     - `name` when resetting a password through Drupal's JSON format on
       `/user/password`, for the same four rules.
     - `mail` in that same reset, for 932120 and 932260 only.
@@ -1066,6 +1080,16 @@ The changes hold in front of every app, and no setting undoes them:
         - `wpTextbox1` on MediaWiki's pages;
         - `text`, `appendtext` and `prependtext` on `/api.php`;
         - `source` in the JSON body of `/rest.php/`.
+    - The passwords when signing in, for each rule that random passwords set off
+      (920270, 920540, 921200, 930100, 930110, 930120, 932125, 932130, 932160,
+      932230, 932250, 932260, 932270, 932280, 932330, 932340, 932370, 932380,
+      933100, 933135, 933180, 933210, 941100, 941120, 941160, 941180, 942100,
+      942151, 942190, 942230, 942290, 942320, 942540, 942550, 944150):
+        - `wpPassword` on MediaWiki's pages;
+        - `lgpassword` and `password` on `/api.php`.
+
+        An SQL injection or a path traversal sent as a password reaches
+        MediaWiki. A script injection is still refused.
 
     These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
     applies when the query has a parameter of the same name.
@@ -1192,6 +1216,23 @@ The changes hold in front of every app, and no setting undoes them:
     Each name contains `.forward`, a file in a home folder. So 930120 refused
     every report the web app sent. The keys' values keep every rule.
 
+    The passwords in a body skip each rule that random passwords set off
+    (920270, 920540, 921200, 930100, 930110, 930120, 932125, 932130, 932160,
+    932230, 932250, 932260, 932270, 932280, 932330, 932340, 932370, 932380,
+    933100, 933135, 933180, 933210, 941100, 941120, 941160, 941180, 942100,
+    942151, 942190, 942230, 942290, 942320, 942540, 942550, 944150):
+    - on `/auth`, `/settings/migration` and `/settings/delete`, and the paths
+      under them:
+        - `user[password]`, `user[password_confirmation]` and
+          `user[current_password]`;
+        - `account_migration[current_password]` and
+          `form_redirect[current_password]`;
+        - `form_delete_confirmation[password]`;
+    - `password` on `/api/v1/accounts`, in form data or JSON.
+
+    An SQL injection or a path traversal sent as a password reaches Mastodon. A
+    script injection is still refused.
+
     These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
     applies when the query has a parameter of the same name.
 
@@ -1324,6 +1365,15 @@ The changes hold in front of every app, and no setting undoes them:
       saves.
     - `name` on `/remote.php/dav/systemtags/`, a new tag.
 
+    `password` in the body of `/login`, the password when signing in, skips each
+    rule that random passwords set off (920270, 920540, 921200, 930100, 930110,
+    930120, 932125, 932130, 932160, 932230, 932250, 932260, 932270, 932280,
+    932330, 932340, 932370, 932380, 933100, 933135, 933180, 933210, 941100,
+    941120, 941160, 941180, 942100, 942151, 942190, 942230, 942290, 942320,
+    942540, 942550, 944150). It applies only when the query has no `password`
+    parameter. An SQL injection or a path traversal sent as the password reaches
+    Nextcloud. A script injection is still refused.
+
     Some fields hold sentences a person writes:
     - `note`, a share's note, on `apps/files_sharing/api/v1/shares` of the OCS
       API and on each share under it;