[Bug]: `nextcloud-whitelist` parser doesn't cover `POST /apps/mail/api/mailboxes/<id>/sync` returning 403

[jiriks74]

Describe the bug
When using Nextcloud Mail, legitimate mailbox synchronization requests trigger a ban within roughly a minute.

CrowdSec sees requests such as:

http_path: /apps/mail/api/mailboxes/<id>/sync
http_status: 403
http_verb: POST
log_type: http_access-log
service: http

To Reproduce

1. Open browser developer tools on the Network tab.
2. Open Nextcloud Mail.
3. Observe POST /apps/mail/api/mailboxes/<id>/sync requests returning 403.
4. Get banned by CrowdSec.

Expected behavior
Legitimate mailbox sync requests should not trigger a ban.

Screenshots

Note

/auth/token in the screenshot is not from Nextcloud but another service.

Additional context
<id> in /apps/mail/api/mailboxes/<id>/sync is a numeric mailbox ID.

[jiriks74]

This seems to be happening because I have some inboxes I'm logged out of (I changed the password at the provider and didn't bother to update it in Nextcloud yet).