Core Rule Set: random passwords pass on the remaining password fields (closes #288)

Each app's sign-in, sign-up, password change and reset fields that had no
exclusion now skip the 35 rules random passwords set off, on that app's
paths and only when the query has no field of that name. Added gitea,
Vaultwarden's admin token, WordPress pass1/pass2/post_password and its REST
password, Drupal's forms and JSON, MediaWiki retype and password on the
pages that take them, Mastodon's challenge, and Nextcloud's confirm, reset,
change, share, LDAP renewal, encryption and OCS fields. Vaultwarden's
clients send a hash, which needs no exclusion.

Model: opus-5-5

README.md

@@ -603,9 +603,12 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
       WebDAV methods, searches, file names, account names, comments and
       documents do too.
 - A random password, as a password manager makes one, gets through these forms:
-    - signing in, on WordPress, Drupal, MediaWiki and Nextcloud;
-    - signing in, signing up, changing the password, and moving or deleting the
-      account, on Mastodon.
+    - signing in, signing up, and changing or resetting a password, on
+      WordPress, Drupal, MediaWiki, Mastodon, Nextcloud and gitea;
+    - moving or deleting the account, on Mastodon;
+    - deleting the account, on gitea;
+    - the admin page, on Vaultwarden, whose apps send a hash of the master
+      password, not the password itself.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again