Core Rule Set: Drupal's ordinary requests pass by default (closes #236)

Adds drupal.conf, the tenth change: on Drupal's paths, the fields that
carry a search, a name, a file name or an address skip the rules that
refused ordinary requests there. The recorded requests from Drupal 11.4
pass at the defaults and while bodies are read; SQL injection, path
traversal and script injection stay refused on those fields. Drupal's
tests share the reader of recorded requests and the attack constants
with the other apps' tests.

Model: opus-5-5

README.md

@@ -581,17 +581,19 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in nine ways so that ordinary requests
-  get through to a code forge and to WordPress. They include git over HTTP and
-  sign-in through Git Credential Manager on a code forge, and saving a post from
-  the block editor on WordPress. On gitea's own paths, its searches, file names
-  and branch names get through too. On WordPress's own paths, its searches and
-  file names do. No setting undoes the changes; "Attack detection" in
-  [`SPEC.md`](SPEC.md) lists them.
+- `smallwebwaf` changes the Core Rule Set in ten ways so that ordinary requests
+  get through to a code forge, to WordPress and to Drupal. They include git over
+  HTTP and sign-in through Git Credential Manager on a code forge, and saving a
+  post from the block editor on WordPress. On gitea's own paths, its searches,
+  file names and branch names get through too. On WordPress's own paths, its
+  searches and file names do. On Drupal's own paths, the page to return to, its
+  searches and its names get through too. No setting undoes the changes; "Attack
+  detection" in [`SPEC.md`](SPEC.md) lists them.
 - These apps work out of the box at the default settings, and their recorded
   ordinary requests pass the Core Rule Set:
     - gitea;
-    - WordPress.
+    - WordPress;
+    - Drupal.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again