fix(waf): 400 duplicate Content-Type; JSON depth limit 64 (round 1)

- hap_listener.tpl (Coraza block): `http-request deny deny_status 400 if
  { req.fhdr_cnt(content-type) gt 1 }`. With two Content-Type lines Coraza
  evaluates every value (text/xml on either line selects its XML processor,
  which accepts a form body without error) while Apache merges the lines
  and PHP parses the body as a form. Measured with Coraza v3.7.0 + PHP 8.3:
  `application/x-www-form-urlencoded` + `text/xml` put the payload in
  $_POST uninspected. Live: two lines -> 400 over HTTP/1.1 and HTTP/2; one
  comma-joined line (browser XHR double-set) is unaffected.
- coraza-spoa/config.yaml: SecRequestBodyJsonDepthLimit 64 (was 1024 from
  the recommended file). Coraza's JSON flattening is quadratic in depth:
  depth 300 (601 B) = 297 ms, depth 1000 (2 KB) = 3.1 s, past the 100 ms
  fail-open timeout. Over the limit it is a 0.1 ms parse error, which WHP's
  enforce-mode rule denies on a complete body (live: depth 65/300/1000 ->
  403, depth 64 and a depth-9 global-styles body -> 200). Legitimate depth
  measured on WordPress core, Gutenberg, WooCommerce and Elementor JSON:
  max 8.
- test-waf-body-inspection.py: 17 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coraza-spoa/config.yaml

@@ -44,6 +44,19 @@ applications:
       SecRequestBodyInMemoryLimit 131072
       SecRequestBodyLimitAction ProcessPartial
 
+      # JSON nesting limit (the recommended file sets 1024). Coraza's JSON
+      # flattener is quadratic in nesting: a 601-byte `[[[...]]]` of depth 300
+      # cost 297 ms and depth 1000 (2 KB) 3.1 s of CPU -- past the 100 ms SPOE
+      # timeout, so the request passed UNINSPECTED (fail-open) while the WAF
+      # burned CPU. Over the limit the body fails to parse (REQBODY_ERROR,
+      # 0.1 ms), which WHP's enforce-mode body-integrity rule denies on a
+      # complete body. Legitimate depth, measured on the JSON shipped in
+      # WordPress 6.x core, Gutenberg, WooCommerce and Elementor (theme.json,
+      # styles/*.json, block.json, checkout schemas): max 8, so a global-styles
+      # save is ~9; 64 leaves ~7x headroom for Divi/Elementor-style module
+      # trees that could not be sampled. Depth 64 itself costs ~21 ms.
+      SecRequestBodyJsonDepthLimit 64
+
       Include @crs-setup.conf.example
 
       # Runtime-managed PRE-CRS exclusions written by WHP UI. Empty by default.