Core Rule Set: gitea's ordinary requests pass by default (closes #198)

The eighth change, internal/waf/gitea.conf, has some fields skip the
rules that refused ordinary gitea requests there, on gitea's paths only:
searches, file names and branch names. Referer skips 944130 too. A
registry's layer reuse skips 932260 on from, the seventh change.

The new setting SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE loads an operator's
own exclusions before the Core Rule Set's rules. The start stops, in
every mode, on a set file that cannot be read or does not parse, names
smallwebwaf's own ids, or holds a directive such as SecRuleRemoveById.

A test sends the recorded gitea requests at the defaults, none refused,
and three attacks, all refused.

Model: opus-5-5

SPEC.md

@@ -717,6 +717,10 @@ every app, and no setting undoes them:
         - branches and tags;
         - packages.
 
+        A user's or an organisation's page is any path of one segment, so on
+        every such path, on any app, `q` skips these three rules, for example on
+        `/search`.
+
         Some of these searches also skip the rule for Java class names (944130),
         which refused `org.apache.commons.logging`.