Core Rule Set tests: inspect requests with no body and no Content-Type once (closes #281)

wantRecordedRequestsPass inspects a recorded request with neither a body
nor a Content-Type header only at the defaults, as the WordPress test does
for a request with no body. With neither, the set that reads bodies has
nothing more to check: what it adds picks how to read a body from the
Content-Type, then reads the body. Every other request is still inspected
both ways. This cuts the package's CPU time under -race by about a fifth.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -620,7 +620,10 @@ var hardValues = []string{"python3", "powershell", "ls%20-la", ".htaccess"}
 
 // wantRecordedRequestsPass checks that none of the recorded ordinary
 // requests in the file name in testdata is refused, at the defaults and
-// while bodies are read. Each request runs as its own parallel subtest.
+// while bodies are read. A request with neither a body nor a Content-Type
+// header is checked only at the defaults: with neither, the set that reads
+// bodies has nothing more to check. Each request runs as its own parallel
+// subtest.
 func wantRecordedRequestsPass(t *testing.T, name string) {
 	t.Helper()
 
@@ -639,6 +642,15 @@ func wantRecordedRequestsPass(t *testing.T, name string) {
 				t.Errorf("%s %s refused: %+v", r.method, r.target, got)
 			}
 
+			typed := slices.ContainsFunc(recorded.Headers, func(header string) bool {
+				name, _, _ := strings.Cut(header, ":")
+
+				return strings.EqualFold(name, "Content-Type")
+			})
+			if recorded.Body == "" && !typed {
+				return
+			}
+
 			got, _ = inspectBody(t, bodies, r, recorded.Body)
 			if got.Score >= threshold {
 				t.Errorf("%s %s %.200q refused while bodies are read: %+v",