Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- tree_path, commit_summary and content on the web editor's pages that
  commit a change: edit, new file, delete, upload, patch and
  cherry-pick;
- every field that names a branch, for Windows commands and command
  names: new_branch_name, old_branch_name, old_ref_name, from, to, head,
  base, branch and new_branch;
- message of one file or several changed through the API, for system
  files and Windows commands.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

internal/coreruleset/recorded_test.go

@@ -150,9 +150,11 @@ func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 }
 
 // TestOrdinaryForgejoRequestsPass checks Forgejo's recorded requests at the
-// defaults only. While bodies are read, the Core Rule Set still refuses the
-// file and branch names some of them carry in a form or JSON body, as it does
-// gitea's (TestGiteaBodiesTheCoreRuleSetRefuses).
+// defaults only. While bodies are read, the Core Rule Set still refuses a new
+// wiki page whose title and text name commands and files, as it does such text
+// in gitea's comments (TestGiteaBodiesTheCoreRuleSetRefuses). The requests
+// that name a file or a branch in a body are checked while bodies are read in
+// TestForgejoNamesInBodiesPass.
 func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	t.Parallel()
 
@@ -168,6 +170,21 @@ func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	}
 }
 
+// TestGiteaNamesInBodiesPass checks gitea's recorded requests that name a
+// file or a branch in a body, while bodies are read too.
+func TestGiteaNamesInBodiesPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "gitea-names-in-bodies.txt")
+}
+
+// TestForgejoNamesInBodiesPass is TestGiteaNamesInBodiesPass for Forgejo.
+func TestForgejoNamesInBodiesPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "forgejo-names-in-bodies.txt")
+}
+
 func TestOrdinaryMastodonRequestsPass(t *testing.T) {
 	t.Parallel()