Core Rule Set tests: check the recorded requests without the race detector (closes #290)

The tests that check the apps' recorded requests move to
internal/coreruleset/recorded_test.go, behind the recorded build tag. The
test phase runs only those tests in a second go test, without -race. The
lint phase reads the same file, with the same tag.

The Gitea and WordPress tests are split in two. Their recorded-request loops
become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass;
their attack checks stay in the race pass as TestGiteaAttacksAreRefused and
TestWordPressAttacksAreRefused.

Model: opus-5-5

Dockerfile

@@ -12,7 +12,7 @@ RUN go mod download
 
 COPY . .
 
-RUN golangci-lint run --config .golangci.yml ./...
+RUN golangci-lint run --config .golangci.yml --build-tags recorded ./...
 
 # Test phase, same shape and for the same reason. The go directive in
 # go.mod is a minimum, so this Go may be newer than the linter's. The
@@ -43,6 +43,12 @@ RUN --mount=type=tmpfs,target=/root/.cache/go-build \
     { echo "--- Rerunning with -v for details ---"; \
       go test -tags no_fs_access -timeout 90s -race -v ./...; exit 1; }
 
+# Second pass: the recorded requests, too slow for make test under -race.
+RUN --mount=type=tmpfs,target=/root/.cache/go-build \
+    go test -tags no_fs_access,recorded -timeout 90s -cover -run '^TestOrdinary' ./internal/coreruleset/... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -tags no_fs_access,recorded -timeout 90s -run '^TestOrdinary' -v ./internal/coreruleset/...; exit 1; }
+
 # Tidy stage: `go mod tidy` in the test phase's Go, so that the files it
 # writes pass the test phase's check. Nothing else depends on it, so only
 # script/tidy, which names the stage after it, builds it.