Core Rule Set: gitea's ordinary requests pass by default (closes #198)

The eighth change, internal/waf/gitea.conf, has some fields skip the
rules that refused ordinary gitea requests there, on gitea's paths only:
searches, file names and branch names. Referer skips 944130 too. A
registry's layer reuse skips 932260 on from, the seventh change.

The new setting SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE loads an operator's
own exclusions before the Core Rule Set's rules. The start stops, in
every mode, on a set file that cannot be read or does not parse, names
smallwebwaf's own ids, or holds a directive such as SecRuleRemoveById.

A test sends the recorded gitea requests at the defaults, none refused,
and three attacks, all refused.

Model: opus-5-5

internal/config/config_test.go

@@ -87,6 +87,7 @@ const (
 	wafDisabledRules     = "SWWAF_WAF_DISABLED_RULES"
 	wafExemptPaths       = "SWWAF_WAF_EXEMPT_PATHS"
 	wafBodyLimit         = "SWWAF_WAF_BODY_LIMIT"
+	exclusionsFile       = "SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE"
 	trapPaths            = "SWWAF_TRAP_PATHS"
 	errorBurstThreshold  = "SWWAF_ERROR_BURST_THRESHOLD"
 	logRemoteURL         = "SWWAF_LOG_REMOTE_URL"
@@ -539,13 +540,14 @@ func TestCoreRuleSetSettings(t *testing.T) {
 			environment{
 				wafMode: config.WAFModeDetect, wafParanoiaLevel: "4", wafAnomalyThreshold: "10",
 				wafDisabledRules: "942100, 920350", wafExemptPaths: "/api/, /static/",
-				wafBodyLimit: "32K",
+				wafBodyLimit: "32K", exclusionsFile: "/etc/smallwebwaf/crs-exclusions.conf",
 			},
 			config.Config{
 				WAFMode: config.WAFModeDetect, WAFParanoiaLevel: 4, WAFAnomalyThreshold: 10,
-				WAFDisabledRules: []int{942100, 920350},
-				WAFExemptPaths:   []string{"/api/", "/static/"},
-				WAFBodyLimit:     32 << 10,
+				WAFDisabledRules:          []int{942100, 920350},
+				WAFExemptPaths:            []string{"/api/", "/static/"},
+				WAFBodyLimit:              32 << 10,
+				CoreRuleSetExclusionsFile: "/etc/smallwebwaf/crs-exclusions.conf",
 			},
 		},
 		{
@@ -565,7 +567,8 @@ func TestCoreRuleSetSettings(t *testing.T) {
 			WAFMode: cfg.WAFMode, WAFParanoiaLevel: cfg.WAFParanoiaLevel,
 			WAFAnomalyThreshold: cfg.WAFAnomalyThreshold,
 			WAFDisabledRules:    cfg.WAFDisabledRules, WAFExemptPaths: cfg.WAFExemptPaths,
-			WAFBodyLimit: cfg.WAFBodyLimit,
+			WAFBodyLimit:              cfg.WAFBodyLimit,
+			CoreRuleSetExclusionsFile: cfg.CoreRuleSetExclusionsFile,
 		}
 		if !reflect.DeepEqual(got, tc.want) {
 			t.Errorf("%v gave\n%+v\nwant\n%+v", tc.env, got, tc.want)
@@ -2327,6 +2330,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		wafDisabledRules:     defaultWAFDisabledRules,
 		wafExemptPaths:       "",
 		wafBodyLimit:         off,
+		exclusionsFile:       "",
 		trapPaths:            "",
 		errorBurstThreshold:  "30",
 		logRemoteURL:         "",