Core Rule Set: random passwords pass on the remaining password fields (closes #288)

Each app's sign-in, sign-up, password change and reset fields that had no
exclusion now skip the 35 rules random passwords set off, on that app's
paths and only when the query has no field of that name. Added gitea,
Vaultwarden's admin token, WordPress pass1/pass2/post_password and its REST
password, Drupal's forms and JSON, MediaWiki retype and password on the
pages that take them, Mastodon's challenge, and Nextcloud's confirm, reset,
change, share, LDAP renewal, encryption and OCS fields. Vaultwarden's
clients send a hash, which needs no exclusion.

Model: opus-5-5

Dockerfile

@@ -20,7 +20,7 @@ RUN golangci-lint run --config .golangci.yml --build-tags recorded ./...
 # needs the C compiler it carries.
 #
 # golang 1.27.1-trixie, 2026-09-19
-FROM golang@sha256:3b77fc618ec235a1ab412de7737f120dd507c57e8d87de4cbb7994fb94275ed5 AS test
+FROM golang@sha256:3b77fc618ec235a1ab412de7737f120dd507c57e8d87de4cbb7994fb94275ed5 AS test-setup
 
 WORKDIR /src
 
@@ -35,20 +35,36 @@ COPY . .
 RUN go mod tidy -diff || \
     { echo "go.mod or go.sum is not tidy: run make tidy" >&2; exit 1; }
 
+# The two passes below are separate stages so that BuildKit runs them at
+# the same time; they share no compiled code, because -race changes every
+# package's build.
+#
 # Go's build cache is kept on a tmpfs, out of the image: nothing uses it
 # after this step, and writing it into the image takes seconds. The tests
 # are built with the no_fs_access tag, as the binary is in the build stage.
+FROM test-setup AS test-race
+
 RUN --mount=type=tmpfs,target=/root/.cache/go-build \
     go test -tags no_fs_access -timeout 90s -race -cover ./... || \
     { echo "--- Rerunning with -v for details ---"; \
       go test -tags no_fs_access -timeout 90s -race -v ./...; exit 1; }
 
 # Second pass: the recorded requests, too slow for make test under -race.
+FROM test-setup AS test-recorded
+
 RUN --mount=type=tmpfs,target=/root/.cache/go-build \
     go test -tags no_fs_access,recorded -timeout 90s -cover -run '^TestOrdinary' ./internal/coreruleset/... || \
     { echo "--- Rerunning with -v for details ---"; \
       go test -tags no_fs_access,recorded -timeout 90s -run '^TestOrdinary' -v ./internal/coreruleset/...; exit 1; }
 
+# The test phase that script/test and the build stage name. Nothing is
+# wanted from the two passes; the copies are what make BuildKit run them.
+# It holds nothing else, so script/test's image takes no time to write.
+FROM scratch AS test
+
+COPY --from=test-race /src/go.sum /src/go.sum
+COPY --from=test-recorded /src/go.sum /src/go.sum
+
 # Tidy stage: `go mod tidy` in the test phase's Go, so that the files it
 # writes pass the test phase's check. Nothing else depends on it, so only
 # script/tidy, which names the stage after it, builds it.