Core Rule Set: Ghost posts and code injection take a script element (closes #358)

While bodies are read, 941110 refused a `<script>` element in an HTML card
that embeds a widget, and in code injection that loads analytics. The new
exclusion 900366 switches 941110 off on the Admin API for `lexical`,
`mobiledoc` and `html` of posts and pages, their `codeinjection_head` and
`codeinjection_foot`, and settings `value`. Snippets, a newsletter's footer
and every other field and path still refuse it; `javascript:` links stay
refused everywhere.

Model: opus-5-5

internal/rproxy/limits_test.go

@@ -93,15 +93,10 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceWAFAllowsIt(t *testing.T) {
 				},
 			)
 
-			// The visitor sends no Connection: close, so Go's server reads the rest
+			got := visit(t, newRequest(t, http.MethodPost, addr, "/",
-			// of the body before it closes the connection. Closed with the rest
+				bytes.NewReader(make([]byte, tc.size))))
-			// unread, the connection is reset while the visitor still sends.
+			if got.status != http.StatusRequestEntityTooLarge {
-			conn := dial(t, addr)
+				t.Errorf("answered %+v, want 413", got)
-			send(t, conn, post+announcedLength(tc.size)+
-				strings.Repeat("x", tc.size))
-
-			if status := readStatus(t, conn); status != http.StatusRequestEntityTooLarge {
-				t.Errorf("status %d, want 413", status)
 			}
 
 			if asked := standIn.question(t); len(asked.body) != tc.asked {