Core Rule Set: random passwords pass at sign-in (closes #276)

A password manager's random password set off 35 Core Rule Set rules,
about 1 in 40 refused. The password fields the app exclusions name now
skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki
wpPassword, lgpassword and password, Mastodon's sign-in, sign-up,
password change, move and delete passwords, and Nextcloud's sign-in
password. Each field's test sends 2,000 random passwords from a fixed
seed, plus one rare password for each rule the 2,000 do not set off.
An SQL injection or a path traversal sent as a password now passes; a
script injection is still refused.

Model: opus-5-5

internal/coreruleset/nextcloud.conf

@@ -61,6 +61,46 @@ SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?login$" \
     ctl:ruleRemoveTargetById=932250;ARGS:/^(?:user|password|redirect_url)$/,\
     ctl:ruleRemoveTargetById=932260;ARGS:/^(?:user|password|redirect_url)$/"
 
+# The password, in the body, skips each rule that random passwords set off.
+SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?login$" \
+    "id:900119,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:password "@eq 0" \
+        "ctl:ruleRemoveTargetById=920270;ARGS:password,\
+        ctl:ruleRemoveTargetById=920540;ARGS:password,\
+        ctl:ruleRemoveTargetById=921200;ARGS:password,\
+        ctl:ruleRemoveTargetById=930100;ARGS:password,\
+        ctl:ruleRemoveTargetById=930110;ARGS:password,\
+        ctl:ruleRemoveTargetById=930120;ARGS:password,\
+        ctl:ruleRemoveTargetById=932125;ARGS:password,\
+        ctl:ruleRemoveTargetById=932130;ARGS:password,\
+        ctl:ruleRemoveTargetById=932160;ARGS:password,\
+        ctl:ruleRemoveTargetById=932230;ARGS:password,\
+        ctl:ruleRemoveTargetById=932250;ARGS:password,\
+        ctl:ruleRemoveTargetById=932260;ARGS:password,\
+        ctl:ruleRemoveTargetById=932270;ARGS:password,\
+        ctl:ruleRemoveTargetById=932280;ARGS:password,\
+        ctl:ruleRemoveTargetById=932330;ARGS:password,\
+        ctl:ruleRemoveTargetById=932340;ARGS:password,\
+        ctl:ruleRemoveTargetById=932370;ARGS:password,\
+        ctl:ruleRemoveTargetById=932380;ARGS:password,\
+        ctl:ruleRemoveTargetById=933100;ARGS:password,\
+        ctl:ruleRemoveTargetById=933135;ARGS:password,\
+        ctl:ruleRemoveTargetById=933180;ARGS:password,\
+        ctl:ruleRemoveTargetById=933210;ARGS:password,\
+        ctl:ruleRemoveTargetById=941100;ARGS:password,\
+        ctl:ruleRemoveTargetById=941120;ARGS:password,\
+        ctl:ruleRemoveTargetById=941160;ARGS:password,\
+        ctl:ruleRemoveTargetById=941180;ARGS:password,\
+        ctl:ruleRemoveTargetById=942100;ARGS:password,\
+        ctl:ruleRemoveTargetById=942151;ARGS:password,\
+        ctl:ruleRemoveTargetById=942190;ARGS:password,\
+        ctl:ruleRemoveTargetById=942230;ARGS:password,\
+        ctl:ruleRemoveTargetById=942290;ARGS:password,\
+        ctl:ruleRemoveTargetById=942320;ARGS:password,\
+        ctl:ruleRemoveTargetById=942540;ARGS:password,\
+        ctl:ruleRemoveTargetById=942550;ARGS:password,\
+        ctl:ruleRemoveTargetById=944150;ARGS:password"
+
 # The folder the Files app shows: /apps/files/?dir=/Powershell%20modules.
 SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/files/" \
     "id:900103,phase:1,pass,nolog,\