Core Rule Set: gitea's search Referer exclusion skips /api/v2/search (closes #270)

Rule 900601 let Referer skip five rules when it named a repository's
search, issues or pull requests with the owner api, such as
/api/v2/search, Mastodon's search. A page opened from there skipped
script and SQL injection checks on Referer. gitea has no owner named
api, so a chained condition now leaves out those paths, as rule 900600
does.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -694,7 +694,10 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 		}
 
 		// Nor is a page opened from them.
-		for _, attack := range []string{scriptTag, injection} {
+		for _, attack := range []string{
+			"<script>alert(1)</script>",
+			"1' OR '1'='1",
+		} {
 			referer := "Referer: https://example.com" + path + "?q=" + attack
 			if got := inspect(t, crs, get("/", referer)); got.Score < threshold {
 				t.Errorf("%s let through: %+v", referer, got)