Core Rule Set: random passwords pass on the remaining password fields (closes #288)

Each app's sign-in, sign-up, password change and reset fields that had no
exclusion now skip the 35 rules random passwords set off, on that app's
paths and only when the query has no field of that name. Added gitea,
Vaultwarden's admin token, WordPress pass1/pass2/post_password and its REST
password, Drupal's forms and JSON, MediaWiki retype and password on the
pages that take them, Mastodon's challenge, and Nextcloud's confirm, reset,
change, share, LDAP renewal, encryption and OCS fields. Vaultwarden's
clients send a hash, which needs no exclusion.

Model: opus-5-5

SPEC.md

@@ -1129,6 +1129,8 @@ The changes hold in front of every app, and no setting undoes them:
         - `wpPassword` on MediaWiki's pages;
         - `password` and `retype` on `Special:ChangeCredentials`;
         - `retype` on `Special:CreateAccount`;
+        - `retype` on `Special:UserLogin`, where a password reset sets the new
+          password;
         - `lgpassword`, `password` and `retype` on `/api.php`.
 
         They skip each rule that random passwords set off:

internal/coreruleset/coreruleset_test.go

@@ -952,6 +952,7 @@ func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
 		{mediawikiAccountChange, passwordField},
 		{mediawikiAccountChange, retypeKey + "="},
 		{mediawikiSignUp, retypeKey + "="},
+		{"/wiki/Special:UserLogin", retypeKey + "="},
 		{"/user/sign_up", passwordField},
 		{"/user/settings/account", "old_password="},
 		{wpLogin, "pass1="},

internal/coreruleset/mediawiki.conf

@@ -198,6 +198,7 @@ SecRule REQUEST_FILENAME "@rx ^/(?:w/)?api\.php$" \
 # pages that take them:
 #   password, retype: changing the password at Special:ChangeCredentials
 #   retype: signing up at Special:CreateAccount
+#   retype: setting the new password after a reset at Special:UserLogin
 # The path names the page, or the path is /index.php and title names it. A title
 # on any other path does not count, so another app's paths under /index.php/
 # keep every rule.
@@ -241,9 +242,9 @@ SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php$|^/(?:(?:w/)?index\.php|wiki)/
         ctl:ruleRemoveTargetById=942550;ARGS:/^(?:password|retype)$/,\
         ctl:ruleRemoveTargetById=944150;ARGS:/^(?:password|retype)$/"
 
-SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php$|^/(?:(?:w/)?index\.php|wiki)/Special:CreateAccount(?:/|$)" \
+SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php$|^/(?:(?:w/)?index\.php|wiki)/Special:(?:CreateAccount|UserLogin)(?:/|$)" \
     "id:900920,phase:1,pass,nolog,chain"
-    SecRule REQUEST_FILENAME|ARGS_GET:title "@rx ^(?:/(?:(?:w/)?index\.php|wiki)/)?Special:CreateAccount(?:/|$)" "chain"
+    SecRule REQUEST_FILENAME|ARGS_GET:title "@rx ^(?:/(?:(?:w/)?index\.php|wiki)/)?Special:(?:CreateAccount|UserLogin)(?:/|$)" "chain"
     SecRule &ARGS_GET:retype "@eq 0" \
         "ctl:ruleRemoveTargetById=920270;ARGS:retype,\
         ctl:ruleRemoveTargetById=920540;ARGS:retype,\

internal/coreruleset/mediawiki_test.go

@@ -255,6 +255,8 @@ func TestMediaWikiSignUpAndPasswordChangeFieldsPass(t *testing.T) {
 		{mediawikiSignUp, formData, retype},
 		{"/index.php/Special:CreateAccount", formData, retype},
 		{"/index.php?title=Special:CreateAccount&returnto=Main_Page", formData, retype},
+		{"/wiki/Special:UserLogin", formData, retype},
+		{mediawikiSignIn, formData, retype},
 		{mediawikiAccountChange, formData, change},
 		{mediawikiAccountChange + subpage, formData, change},
 		{"/index.php/Special:ChangeCredentials", formData, change},