Proposed changes

When sending JSON data to libModSecurity3/Coraza, variable names are prefixed with .json. If the variable name is called profile, then that will translate to ARGS_NAMES:json.profile which matches one of the entries inside of lfi-os-files.data resulting in a false positive. This PR adds a configure-time rule exclusion to resolve this false positive.

closes: #4471

PR Checklist

• I have read the CONTRIBUTING doc
• I have added positive tests proving my fix/feature works as intended.
• I have added negative tests that prove my fix/feature considers common cases that might end in false positives
• In case you changed a regular expression, you are not adding a ReDOS for pcre. You can check this using regexploit
• My test use the comment field to write the expected behavior
• I have added documentation for the rule or change (when appropriate)

Further comments

For the reviewer

• Positive and negative tests were added
• Tests cover the intended fix/feature properly
• No usage of dangerous constructs like ctl:requestBodyAccess=Off were used in the rule
• In case a regular expression was changed, there is no ReDOS
• Documentation is clear for the rule/change