Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237)

Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields
that carry a search, a title, a name, a file name or an address skip the
four rules that read them as commands or system files, and the wikitext
fields skip the rules that refused saving a page. The reasons on the admin
pages skip only 930120 and 932120. /index.php counts as MediaWiki's only
with a page title in its query or after its path, since WordPress serves it
too. The requests recorded from MediaWiki 1.46.2, with and without short
URLs and on the admin pages, pass at the defaults and while bodies are
read. The app tests share the check of recorded requests and the list of
hard values.

Model: opus-5-5

internal/coreruleset/mediawiki_test.go

@@ -228,7 +228,9 @@ func TestMediaWikiCommandAttackIsRefusedOutsideWikitext(t *testing.T) {
 
 	crs := atDefaults(t)
 
-	for _, target := range append([]string{"/load.php?modules="}, mediawikiQueryFields...) {
+	targets := append([]string{"/load.php?modules="}, mediawikiQueryFields...)
+
+	for _, target := range targets {
 		got := inspect(t, crs, get(target+mediawikiCommandAttack))
 		if got.Score < mediawikiThreshold {
 			t.Errorf("%s let through: %+v", target, got)