Core Rule Set: more of Drupal's ordinary fields pass (closes #244)

Names, searches, addresses and the page to return to on more Drupal
paths skip the rules that misfire on them: 930120, 932120, 932250 and
932260, plus 932230 and 932235 on destination only. The oEmbed url
skips only 930120 and 932120. Every Drupal path may carry a language
prefix such as /fr. Requests recorded from Drupal 11.4.11 with plain
words, python3, powershell, ls -la and .htaccess are added to the
test data; tests show attacks and "; wget ..." still refused on each
new field.

Model: opus-5-5

SPEC.md

@@ -908,13 +908,20 @@ changes hold in front of every app, and no setting undoes them:
       `filemime`, `info`, `subject`, `author_name`, `search`, `q` and
       `destination`.
     - `destination` on the pages Drupal links to with one, such as
-      `/node/1/edit`, `/user/login` and `/user/logout`.
+      `/node/1/edit`, `/user/login`, `/node/1/revisions/2/revert`,
+      `/block/add/basic` and `/big_pipe/no-js`.
     - `keys` on `/search` and the pages under it.
-    - `q` on `/entity_reference_autocomplete/`.
+    - `q` on these autocompletes:
+        - `/entity_reference_autocomplete/`;
+        - `/ckeditor5/{editor}/entity-link-suggestions`;
+        - `/block-category/autocomplete`.
     - Every `filter[...]` field on `/jsonapi/`.
+    - `name` on `/user/password`, `/media-library` and `/views/ajax`, in the
+      query or a body.
 
     `destination` also skips 932230 and 932235, because it holds the address of
-    a page of results.
+    a page of results. `url` on `/media/oembed`, the address of a video, skips
+    only 930120 and 932120.
 
     These fields of a body skip the rules that refused them:
     - On the node, comment and media forms, for 930120, 932120, 932250 and
@@ -927,18 +934,26 @@ changes hold in front of every app, and no setting undoes them:
         - the comment subject;
         - the media name;
         - the image text.
-    - `title`, `subject` and `body.summary` through JSON:API, for the same four
-      rules.
-    - The body and comment body on those forms and through JSON:API, which hold
-      HTML and any code it shows.
-    - `pass` when signing in (930120, 932120, 932250, 932260).
+    - On the tag, custom block and contact forms, for the same four rules:
+        - the tag's name and description;
+        - the block description and body;
+        - the subject and message of a contact message.
+    - `title`, `subject`, `body.summary`, `name`, `revision_log`, `info` and
+      `description.value` through JSON:API, for the same four rules.
+    - The title saved through Drupal's JSON format on `/node/{id}`, for the same
+      four rules.
+    - The body and comment body on the node and comment forms and through
+      JSON:API, which hold HTML and any code it shows.
+    - `name` and `pass` when signing in (930120, 932120, 932250, 932260).
+    - `name` and `mail` when signing up, editing an account and commenting
+      without an account, for the same four rules.
 
     These exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None applies
     when the query has a parameter of the same name.
 
     Elsewhere these fields keep every rule. The paths are those of Drupal at the
-    site root. An app other than Drupal that serves one of them must check these
-    fields itself.
+    site root, with or without a language prefix such as `/fr`. An app other
+    than Drupal that serves one of them must check these fields itself.
 
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.