🐛 tests: appsec scenario uses OWASP CRS inband collection

appsec-virtual-patching only ships CVE-specific rules, not generic
SQLi. Switch to crowdsecurity/appsec-crs-inband (the blocking OWASP
Core Rule Set) and use a SQLi probe that CRS paranoia level 1
matches (rule 942100/942130).

tests/e2e/scenarios/appsec/acquis.yaml

@@ -1,5 +1,5 @@
 listen_addr: 0.0.0.0:7422
-appsec_config: crowdsecurity/virtual-patching
+appsec_config: crowdsecurity/crs-inband
 name: e2eAppSec
 source: appsec
 labels:

tests/e2e/scenarios/appsec/docker-compose.yml

@@ -41,7 +41,7 @@ services:
     image: crowdsecurity/crowdsec:v1.7.8
     container_name: crowdsec
     environment:
-      COLLECTIONS: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules"
+      COLLECTIONS: "crowdsecurity/appsec-crs-inband"
       BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5
       CUSTOM_HOSTNAME: crowdsec
       CROWDSEC_BYPASS_DB_VOLUME_CHECK: "true"

tests/e2e/scenarios/appsec/run.sh

@@ -33,8 +33,8 @@ wait_for_status http://localhost:8000/foo 200 30
 echo "[$SCENARIO] benign request must pass"
 assert_status http://localhost:8000/foo 200
 
-echo "[$SCENARIO] SQL-injection-like query string must be blocked by AppSec virtual patching"
-# CRS-style SQLi probe — caught by crowdsecurity/appsec-generic-rules.
-assert_status "http://localhost:8000/foo?id=1%27%20UNION%20SELECT%201%2C2%2C3--" 403
+echo "[$SCENARIO] SQL-injection-like query string must be blocked by OWASP CRS (inband)"
+# Classic SQLi probe: ?id=1' OR '1'='1 — caught by CRS rule 942100/942130 (paranoia 1).
+assert_status "http://localhost:8000/foo?id=1%27%20OR%20%271%27%3D%271" 403
 
 echo "[$SCENARIO] OK"