Disable Modsec on saving custom css

conf/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf

@@ -16,9 +16,10 @@ SecRule REQUEST_URI "@beginsWith /wp-admin/site-health.php" \
     nolog,\
     ctl:ruleEngine=Off"
 
-SecRule REQUEST_URI "@beginsWith /wp-admin/themes.php" \
+SecRule REQUEST_FILENAME "@endsWith /wp-admin/themes.php" \
     "id:1002,\
+    phase:2,\
     pass,\
     nolog,\
-    ctl:ruleRemoveByTag=attack-xss"
+    ctl:ruleRemoveTargetByTag=CRS;ARGS:newcontent"