Core Rule Set: Drupal's ordinary requests pass by default (closes #236)

Adds drupal.conf, the tenth change: on Drupal's paths, the fields that
carry a search, a name, a file name or an address skip the rules that
refused ordinary requests there. The recorded requests from Drupal 11.4
pass at the defaults and while bodies are read; SQL injection, path
traversal and script injection stay refused on those fields. Drupal's
tests share the reader of recorded requests and the attack constants
with the other apps' tests.

Model: opus-5-5

SPEC.md

@@ -81,7 +81,7 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/coreruleset`: the Core Rule Set, with the nine changes listed
+    - `internal/coreruleset`: the Core Rule Set, with the ten changes listed
       under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
@@ -674,8 +674,8 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions; the eighth and ninth changes below hold gitea's
-  and WordPress's.
+  holds an app's own exclusions; the eighth, ninth and tenth changes below hold
+  gitea's, WordPress's and Drupal's.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
       `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
@@ -721,9 +721,9 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in nine ways, since in front of
-gitea and WordPress it would otherwise refuse ordinary requests. The changes
-hold in front of every app, and no setting undoes them:
+`smallwebwaf` changes the Core Rule Set 4.25.0 in ten ways, since in front of
+gitea, WordPress and Drupal it would otherwise refuse ordinary requests. The
+changes hold in front of every app, and no setting undoes them:
 
 1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
    and `OPTIONS`. APIs, container image pushes and package uploads use them.
@@ -754,9 +754,10 @@ hold in front of every app, and no setting undoes them:
     catch reaches the app, such as the command `|cat /etc/passwd`. Path
     traversal, SQL and script injection, and PHP, Java and Node.js code are
     still refused there. Other parameters keep all three rules, except on the
-    gitea and WordPress paths the eighth and ninth changes name. An app that
-    uses one of these parameters as a file on the server, or passes it to a
-    shell, must check the value itself. A rule file can refuse it instead.
+    gitea, WordPress and Drupal paths the eighth, ninth and tenth changes name.
+    An app that uses one of these parameters as a file on the server, or passes
+    it to a shell, must check the value itself. A rule file can refuse it
+    instead.
 
 5. Two cookies are left out, and `Referer` keeps fewer rules:
     - The Core Rule Set reads the request without the `gitea_flash` and
@@ -897,6 +898,46 @@ hold in front of every app, and no setting undoes them:
     the site root. An app other than WordPress that serves one of them must
     check these fields itself.
 
+10. On Drupal's paths, some fields skip the rules that refused ordinary Drupal
+    requests there. `internal/coreruleset/drupal.conf` lists each rule and the
+    request it refused. These query fields skip the lists of system files and
+    command names (930120, 932120, 932250, 932260):
+    - On every page under `/admin`: `title`, `name`, `user`, `filename`,
+      `filemime`, `info`, `subject`, `author_name`, `search`, `q` and
+      `destination`.
+    - `destination` on the pages Drupal links to with one, such as
+      `/node/1/edit`, `/user/login` and `/user/logout`.
+    - `keys` on `/search` and the pages under it.
+    - `q` on `/entity_reference_autocomplete/`.
+    - Every `filter[...]` field on `/jsonapi/`.
+
+    `destination` also skips 932230 and 932235, because it holds the address of
+    a page of results.
+
+    These fields of a body skip the rules that refused them:
+    - On the node, comment and media forms, for 930120, 932120, 932250 and
+      932260:
+        - the title;
+        - the summary;
+        - the tags;
+        - the address;
+        - the revision note;
+        - the comment subject;
+        - the media name;
+        - the image text.
+    - `title`, `subject` and `body.summary` through JSON:API, for the same four
+      rules.
+    - The body and comment body on those forms and through JSON:API, which hold
+      HTML and any code it shows.
+    - `pass` when signing in (930120, 932120, 932250, 932260).
+
+    These exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None applies
+    when the query has a parameter of the same name.
+
+    Elsewhere these fields keep every rule. The paths are those of Drupal at the
+    site root. An app other than Drupal that serves one of them must check these
+    fields itself.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.