www/bunkerweb: Update to 1.6.13

This covers the 1.6.12 and 1.6.13 releases.

Security: session fixation on login and an open redirect via the
post-login "next" parameter in the web UI, a second open redirect in
the antibot post-challenge flow, and cache deletion routes that
bypassed authorization. Biscuit token generation now binds the Host
header, client IP and username as typed terms, and adds an optional
API_ALLOWED_HOSTS allowlist. Reverse DNS results are forward-confirmed
before an IGNORE_RDNS or GREYLIST_RDNS suffix match is honored, so a
self-configured PTR record no longer bypasses blocking. ACME challenge
tokens are validated against the base64url character set, closing a
path traversal through the internal API. TOTP verification is enforced
on the exact validation endpoint instead of any path containing /totp.

New settings: REVERSE_PROXY_SSL_VERIFY and friends for upstream HTTPS
certificate verification, USE_LIMIT_REQ_GLOBAL and
LIMIT_REQ_GLOBAL_RATE for an aggregate per-service request rate,
COUNTRY_IGNORE_URI, ANTIBOT_SUCCESS_URI, SCHEDULER_MAX_WORKERS and
MTLS_URL_n for per-path mTLS. ANTIBOT_IGNORE_URI now matches full
request URIs including query strings, and the UI logs viewer gained
syntax highlighting, severity filters, search and live tail.

Fixes include Let's Encrypt cache poisoning that could cause
fleet-wide certbot AccountNotFound, an error after every successful
basic-auth login, and KEEP_UPSTREAM_HEADERS silently dropping
Content-Security-Policy-Report-Only.

Bundled dependencies were updated, among them ModSecurity 3.0.16 and
the OWASP Core Rule Set v4.27.0.

Changes:
https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.12
Changes:
https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.13

Sponsored by: Netzkommune GmbH