GHSA-w253-m66g-rx24: Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

Coraza fails to inspect URL-encoded form bodies when their valid Content-Type contains a media-type parameter, for example:

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

An unauthenticated attacker can use this header to hide the complete form body from custom Coraza rules that inspect ARGS_POST or REQUEST_BODY, while the bundled Go HTTP middleware forwards the body and the backend parses it normally.

This is a deterministic request-body inspection bypass. Suggested severity: Medium. Current OWASP CRS includes rule 901340, which forces fallback inspection and mitigates this path; this report does not claim a bypass of an unmodified current CRS ruleset