Core Rule Set: Ghost's ordinary requests pass by default (closes #357)

Ghost 6.76.0's ordinary traffic, recorded in `testdata/ghost-requests.txt`,
passes at the default settings and while bodies are read. It covers public
pages, members' sign-up and sign-in, the admin, the editor saving and
publishing posts and pages with code blocks and HTML cards, tags, settings,
staff invitations, uploads, newsletter settings, and both APIs. Ghost's
fixes, in the new `ghost.conf`, let through `filter`, the member `search`
and the embed `url` in the query, and plain text, addresses, articles, code
injection and passwords in JSON bodies. A `<script>` element and a
`javascript:` link stay refused in articles and code injection. `SWW_APPS`
names Ghost `ghost`. `README.md` lists Ghost; `SPEC.md` lists its fixes.

Model: opus-5-5

README.md

@@ -605,10 +605,13 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
       email addresses and its encrypted file names;
     - `nextcloud`, whose fixes let through its sync client, its WebDAV methods,
       its searches, its file names, its account names, its comments and its
-      documents.
+      documents;
+    - `ghost`, whose fixes let through its filters, its searches, its names, its
+      email addresses, its code injection, its settings and a post saved from
+      its editor, HTML included.
 - A random password, as a password manager makes one, gets through these forms:
     - signing in, signing up, and changing or resetting a password, on
-      WordPress, Drupal, MediaWiki, Mastodon, Nextcloud and gitea;
+      WordPress, Drupal, MediaWiki, Mastodon, Nextcloud, gitea and Ghost;
     - moving or deleting the account, on Mastodon;
     - deleting the account, on gitea;
     - the admin page, on Vaultwarden, whose apps send a hash of the master