Core Rule Set tests: inspect bodiless recorded requests once (closes #281)

wantRecordedRequestsPass inspects a recorded request with no body only at
the defaults, as the WordPress test already does. With no body to read, the
second inspection ran the same rules on the same request. Requests with a
body are still inspected both ways. This cuts the package's CPU time under
-race by about a fifth.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -620,7 +620,9 @@ var hardValues = []string{"python3", "powershell", "ls%20-la", ".htaccess"}
 
 // wantRecordedRequestsPass checks that none of the recorded ordinary
 // requests in the file name in testdata is refused, at the defaults and
-// while bodies are read. Each request runs as its own parallel subtest.
+// while bodies are read. A request with no body is checked only at the
+// defaults: reading bodies changes nothing for it. Each request runs as its
+// own parallel subtest.
 func wantRecordedRequestsPass(t *testing.T, name string) {
 	t.Helper()
 
@@ -639,6 +641,10 @@ func wantRecordedRequestsPass(t *testing.T, name string) {
 				t.Errorf("%s %s refused: %+v", r.method, r.target, got)
 			}
 
+			if recorded.Body == "" {
+				return
+			}
+
 			got, _ = inspectBody(t, bodies, r, recorded.Body)
 			if got.Score >= threshold {
 				t.Errorf("%s %s %.200q refused while bodies are read: %+v",