Proposed changes

PR #4476 fixed a false positive in a French address which accidently introduced a regression resulting in virtually all user-agents with a comma being blocked. While most issues were fixed in #4537 there are still issues with payloads that contain a comma but no whitespace.

I think we should backport this for the LTS since it's a common enough false positive.

PR Checklist

• I have read the CONTRIBUTING doc
• I have added positive tests proving my fix/feature works as intended.
• I have added negative tests that prove my fix/feature considers common cases that might end in false positives
• In case you changed a regular expression, you are not adding a ReDOS for pcre. You can check this using regexploit
• My test use the comment field to write the expected behavior
• I have added documentation for the rule or change (when appropriate)

Further comments

For the reviewer

• Positive and negative tests were added
• Tests cover the intended fix/feature properly
• No usage of dangerous constructs like ctl:requestBodyAccess=Off were used in the rule
• In case a regular expression was changed, there is no ReDOS
• Documentation is clear for the rule/change