Cyber Securitise firewall: OWASP CRS rules

rules.php is generated (tools/waf/compile.php in the plugin's source) from:

  OWASP CRS (Core Rule Set) v4.30.0
  https://github.com/coreruleset/coreruleset
  Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
  Copyright (c) 2021-2026 CRS project. All rights reserved.

  OWASP CRS WordPress Rule Exclusions Plugin v1.2.0
  https://github.com/coreruleset/wordpress-rule-exclusions-plugin
  Copyright (c) 2022-2026 OWASP CRS project. All rights reserved.

Both are distributed under the Apache License, Version 2.0 (LICENSE-CRS.txt
in this folder). Changes made: the paranoia level 1 request rules (files
REQUEST-913, 920, 921, 930, 931, 932, 933, 934, 941, 942 and 943, plus two
content-type rules of 901) and the exclusions were converted from ModSecurity
configuration into PHP data; @pm and @pmFromFile phrase lists were turned
into equivalent regular expressions; rules 941100 and 942100 (libinjection
operators) are left out. The regular expressions themselves are unchanged.

The rule engine that runs them (engine.php) is Cyber Securitise's own code.
