920120 is a negated rule and must say so

ModSecurity defines 920120 with !@rx: its pattern describes a filename made only
of SAFE characters, and the rule fires when the filename does NOT match. A
quote, an apostrophe, a semicolon, an equals sign or a backslash in a filename
is an attempt to break out of the Content-Disposition header, and that is what
the rule exists to catch.

This format had no way to express a negation, so the rule was imported as a
plain pattern and means the exact opposite: it matched every legitimate upload
and missed every dangerous filename. It did no harm only because the engine
carried a built-in rule under the same ID — a different rule entirely, matching
content-type.*boundary.* on every ordinary multipart upload — which took
precedence.

The engine gained a `negate` field (3.0.61); this declares it. Both are needed:
the flag alone with no engine support does nothing, and engine support with no
flag leaves the rule inverted.

build_datetime bumped, because an agent skips a feed whose stamp has not moved
without reading it.

rulesets.json

@@ -1,5 +1,5 @@
 {
-  "build_datetime": "2026-10-30T17:50:13Z",
+  "build_datetime": "2026-10-30T21:47:18Z",
   "owasp_top_10": {
     "version": "2025",
     "url": "https://owasp.org/Top10/2025/",
@@ -154,7 +154,8 @@
             "OWASP_CRS/PROTOCOL-ENFORCEMENT",
             "capec/1000/210/272"
           ],
-          "paranoia_level": 1
+          "paranoia_level": 1,
+          "negate": true
         },
         {
           "id": "920260",