Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- tree_path, commit_summary and content on the web editor's pages that
  commit a change: edit, new file, delete, upload, patch and
  cherry-pick;
- every field that names a branch, for Windows commands and command
  names: new_branch_name, old_branch_name, old_ref_name, from, to, head,
  base, branch and new_branch;
- message of one file or several changed through the API, for system
  files and Windows commands.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

internal/coreruleset/forgejo.conf

@@ -115,3 +115,17 @@ SecRule REQUEST_FILENAME \
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
     ctl:ruleRemoveTargetById=932250;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
+
+# Forgejo renames a branch on its own path, where from and to name branches.
+# They skip these rules:
+#   932120: fix-powershell-module
+#   932260: feat/docker-support
+# They are read only while SWW_WAF_BODY_LIMIT is set, and skip nothing when the
+# query has a parameter of the same name.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/rename_branch$" \
+    "id:900666,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:from|to)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:from,\
+        ctl:ruleRemoveTargetById=932260;ARGS:from,\
+        ctl:ruleRemoveTargetById=932120;ARGS:to,\
+        ctl:ruleRemoveTargetById=932260;ARGS:to"