Core Rule Set tests: inspect bodiless recorded requests once (closes #281)

wantRecordedRequestsPass inspects a recorded request with no body only at
the defaults, as the WordPress test already does. With no body to read, the
second inspection ran the same rules on the same request. Requests with a
body are still inspected both ways. This cuts the package's CPU time under
-race by about a fifth.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -620,10 +620,9 @@ var hardValues = []string{"python3", "powershell", "ls%20-la", ".htaccess"}
 
 // wantRecordedRequestsPass checks that none of the recorded ordinary
 // requests in the file name in testdata is refused, at the defaults and
-// while bodies are read. A request with neither a body nor a Content-Type
+// while bodies are read. A request with no body is checked only at the
-// header is checked only at the defaults: with neither, the set that reads
+// defaults: reading bodies changes nothing for it. Each request runs as its
-// bodies has nothing more to check. Each request runs as its own parallel
+// own parallel subtest.
-// subtest.
 func wantRecordedRequestsPass(t *testing.T, name string) {
 	t.Helper()
 
@@ -642,12 +641,7 @@ func wantRecordedRequestsPass(t *testing.T, name string) {
 				t.Errorf("%s %s refused: %+v", r.method, r.target, got)
 			}
 
-			typed := slices.ContainsFunc(recorded.Headers, func(header string) bool {
+			if recorded.Body == "" {
-				name, _, _ := strings.Cut(header, ":")
-
-				return strings.EqualFold(name, "Content-Type")
-			})
-			if recorded.Body == "" && !typed {
 				return
 			}