Core Rule Set: gitea's ordinary requests pass by default (closes #198)

The eighth change, internal/waf/gitea.conf, has some fields skip the
rules that refused ordinary gitea requests there, on gitea's paths only:
searches, file names and branch names. Referer skips 944130 too. A
registry's layer reuse skips 932260 on from, the seventh change.

The new setting SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE loads an operator's
own exclusions before the Core Rule Set's rules. The start stops, in
every mode, on a set file that cannot be read or does not parse, names
smallwebwaf's own ids, or holds a directive such as SecRuleRemoveById.

A test sends the recorded gitea requests at the defaults, none refused,
and three attacks, all refused.

Model: opus-5-5

SPEC.md

@@ -717,10 +717,6 @@ every app, and no setting undoes them:
         - branches and tags;
         - packages.
 
-        A user's or an organisation's page is any path of one segment, so on
-        every such path, on any app, `q` skips these three rules, for example on
-        `/search`.
-
         Some of these searches also skip the rule for Java class names (944130),
         which refused `org.apache.commons.logging`.
 

internal/smallwebwaf/smallwebwaf.go

@@ -178,7 +178,8 @@ func RunServeWAF(ctx context.Context, params Params) int {
 
 	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
 	if err != nil {
-		processLog.Error("cannot listen on SWWAF_LISTEN_ADDR", "error", err.Error())
+		processLog.Error("cannot listen on SWWAF_LISTEN_ADDR",
+			"error", err.Error())
 
 		return 1
 	}