Core Rule Set tests: check the recorded requests without the race detector (closes #290)

The tests that check the apps' recorded requests move to
internal/coreruleset/recorded_test.go, behind the recorded build tag. The
test phase runs only those tests in a second go test, without -race. The
lint phase reads the same file, with the same tag.

The Gitea and WordPress tests are split in two. Their recorded-request loops
become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass;
their attack checks stay in the race pass as TestGiteaAttacksAreRefused and
TestWordPressAttacksAreRefused.

Model: opus-5-5

internal/coreruleset/mediawiki_test.go

@@ -42,12 +42,6 @@ const (
 	mediawikiUploadPage = "/index.php/Special:Upload"
 )
 
-func TestOrdinaryMediaWikiRequestsPass(t *testing.T) {
-	t.Parallel()
-
-	wantRecordedRequestsPass(t, "mediawiki-requests.txt")
-}
-
 // mediawikiQueryFields and mediawikiBodyFields together hold every field that
 // skips 930120, 932120, 932250 and 932260, other than wikitext, wpTitles and
 // the JSON fields of /rest.php/. mediawikiQueryFields sends each in the query, on a