Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352)

Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips
930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and
Forgejo's /admin/ alike, and in the body of the admin forms that adopt a
repository or activate an email. A repository's packages page and the admin
packages page search package names, so they join 900602, which also skips
944130. 900605, which lets /bin/sh through in q on branches and owner
packages, now also covers the tags page and those two pages, since tag and
package names can hold a slash.

Model: opus-5-5

SPEC.md

@@ -827,7 +827,10 @@ The changes hold in front of every app, and no setting undoes them:
         - repositories;
         - users and organisations;
         - branches and tags;
-        - packages, on its pages and in its API.
+        - packages, in its API and on these pages:
+            - an owner's packages page;
+            - a repository's packages page;
+            - the admin page of packages.
 
         A user's or an organisation's page has a path of one segment, such as
         `/alice`. So on any app, `q` skips these rules on every path of one
@@ -850,10 +853,32 @@ The changes hold in front of every app, and no setting undoes them:
         Some of these searches also skip the rule for Java class names (944130),
         which refused `org.apache.commons.logging`.
 
-        A branch or package name can hold a slash, as `feat/docker-support`
-        does. So `q` on a repository's branches page and on an owner's packages
-        page also skips the rule for shell paths (932160), which refused
-        `/bin/sh`.
+        A branch, tag or package name can hold a slash, as `feat/docker-support`
+        does. So `q` skips the rule for shell paths (932160) too on these pages,
+        where it refused `/bin/sh`:
+        - a repository's branches, tags and packages pages;
+        - an owner's packages page;
+        - the admin page of packages.
+
+    - `q` on gitea's other searches, for the same four rules. Words such as
+      `python3`, `powershell`, `ls -la` and `.htaccess` were refused there. The
+      searches are:
+        - the list of repositories a user watches;
+        - an organisation's issues, pull requests and milestones of one team;
+        - an organisation's search for teams;
+        - the milestones and projects of a repository, a user or an
+          organisation;
+        - the issues of one milestone;
+        - the versions of a package;
+        - the issues suggested when an issue is mentioned;
+        - the runner lists of the site, a user, an organisation and a
+          repository;
+        - the admin lists of users, organisations, repositories, unadopted
+          repositories and emails.
+
+        Most send `q` in the query string. The admin forms that adopt a
+        repository or activate an email send it in the body. gitea serves its
+        admin pages under `/-/admin/` and Forgejo under `/admin/`.
 
     - The path of these requests, which names a file:
         - a file's page;