Core Rule Set: Vaultwarden's ordinary requests pass by default (closes #239)

Adds vaultwarden.conf, the thirteenth change, with rule ids 900150 to
900153. On Vaultwarden's account, organization and admin paths, names and
password hints skip 930120, 932120, 932250 and 932260, and so does a
security key's name. Email addresses skip 930120, 932120 and 932260
there, on the two-factor email paths and when signing in with another
device. So does the address of the admin page's test email. The data
breach report's address does too. The encrypted names of uploaded
attachments and file sends skip 920120. Requests recorded from
Vaultwarden 1.37.5 through the web vault, the Bitwarden command line
client and the admin page pass at the defaults and while bodies are read.

Model: opus-5-5

README.md

@@ -581,24 +581,24 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in twelve ways so that ordinary
-  requests get through to the apps listed below. These requests include git over
-  HTTP and sign-in through Git Credential Manager on a code forge, and saving a
-  post from the block editor on WordPress. On gitea's own paths, its searches,
-  file names and branch names get through too. On WordPress's own paths, its
-  searches, names and file names do. On Drupal's own paths, the page to return
-  to, its searches and its names get through too. On MediaWiki's own paths, its
-  searches, page titles, names and wikitext do. On Mastodon's own paths, its
-  searches, names, email addresses, posts and deliveries from other servers do.
-  No setting undoes the changes; "Attack detection" in [`SPEC.md`](SPEC.md)
-  lists them.
+- `smallwebwaf` changes the Core Rule Set in thirteen ways so that ordinary
+  requests get through to the apps listed below. No setting undoes the changes;
+  "Attack detection" in [`SPEC.md`](SPEC.md) lists them.
 - These apps work out of the box at the default settings, and their recorded
   ordinary requests pass the Core Rule Set:
-    - gitea;
-    - WordPress;
-    - Drupal;
-    - MediaWiki;
-    - Mastodon.
+    - gitea: git over HTTP and sign-in through Git Credential Manager get
+      through. On gitea's own paths, its searches, file names and branch names
+      do too.
+    - WordPress: saving a post from the block editor gets through. On
+      WordPress's own paths, its searches, names and file names do too.
+    - Drupal: on Drupal's own paths, the page to return to, its searches and its
+      names get through.
+    - MediaWiki: on MediaWiki's own paths, its searches, page titles, names and
+      wikitext get through.
+    - Mastodon: on Mastodon's own paths, its searches, names, email addresses,
+      posts and deliveries from other servers get through.
+    - Vaultwarden: on Vaultwarden's own paths, its names, password hints, email
+      addresses and encrypted file names get through.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again