Core Rule Set: the package registries' searches of gitea and Forgejo pass (closes #354)

Recorded from gitea 1.27.3 and Forgejo 17.0.1 with each registry's own
client, and curl for the Chef cookbook list, NuGet's Packages() and the
counts at Search()/$count and Packages()/$count, with python3,
powershell, ls -la, .htaccess, file names and plain words. q on the
Cargo, Chef, Composer and Conan searches and NuGet's search service
joins 900603. 900605 lets /bin/sh through on Composer and Conan. New:
900609 for npm's text; 900611, in phase 2, lets one q shaped as a Conan
reference with no */, such as zlib/*, skip 942100; 900612 for NuGet's
Search(), Packages() and their counts: searchTerm, $filter, and the
names $filter, $orderby and $top for 942290.

Model: opus-5-5

internal/coreruleset/gitea.conf

@@ -269,12 +269,12 @@ SecRule REQUEST_FILENAME "@rx ^/api/packages/[^/]+/npm/-/v1/search$" \
 
 # A Conan search takes a pattern such as zlib/*, which the rule for SQL
 # injection (942100) refused in q. q skips that rule only when the request has
-# one q, in the query string or the body, with the shape of a Conan reference.
-# A reference is a name, then optionally / and a version, then optionally @
-# and a user, then optionally / and a channel. Each part is made of letters,
-# digits, _, ., +, - and *. q must also hold no */, which ends an SQL comment.
-# Such a q has no quote, no space and no comment between two words, so SQL
-# injection such as 1' OR '1'='1, 1/**/or/**/1 or 1/*@*/or-1 stays refused.
+# one q, in the query string or the body, with the shape of a Conan reference:
+# a name, then optionally / and a version, then optionally @ and a user, then
+# optionally / and a channel. Each part is made of letters, digits, _, ., +, -
+# and *. q must also hold no */, which ends an SQL comment. Such a q has no
+# quote, no space and no comment between two words, so SQL injection such as
+# 1' OR '1'='1, 1/**/or/**/1 or 1/*@*/or-1 stays refused.
 # This rule is in phase 2, because a phase 1 rule runs before the body is read
 # and cannot see a q there. It checks tx.app_gitea, since the skip above does
 # not reach phase 2.