libmodsecurity3: SecAction can't be disabled via ctl action

Describe the bug

In libmodsecurity3, SecAction can't be disabled via a ctl action like with SecRules. This issue isn't present in ModSecurity2.

Logs and dumps

N/A

To Reproduce

Steps to reproduce the behavior:

1. Have a fresh Ubuntu 22.04 server setup, this bug was a bit tricky to reproduce when I was opening this issue.
2. ModSecurity was tested and installed using digitalwave's ModSecurity repository and apt install nginx-extras libnginx-mod-http-modsecurity
3. I installed this version of CRSv4 RC-2 and ModSecurity.conf with the SecRuleEngine directive set to on, but it shouldn't matter what rulesets are used.
4. Create this test conf file, but make sure to load it before any blocking rules (i.e Include /etc/nginx/modsecurity/coreruleset/rules/*.conf)

SecRule REQUEST_HEADERS:Host "!@streq example.com" "id:1,phase:1,pass,t:none,nolog,ctl:ruleRemoveById=2"

SecAction \
  "id:2,phase:1,pass,t:none,nolog,ctl:ruleRemoveByTag=OWASP_CRS"

5. restart nginx then try to send an attack payload, rule 2 should be disabled yet it still disables OWASP_CRS curl 127.0.0.1?exec/bin/bash
6. If you modify the test file to this, then rule 2 is disabled and everything works as expected:

SecRule REQUEST_HEADERS:Host "!@streq example.com" "id:1,phase:1,pass,t:none,nolog,ctl:ruleRemoveById=2"

SecRule REQUEST_FILENAME "@unconditionalMatch" \
  "id:2,phase:1,pass,t:none,nolog,ctl:ruleRemoveByTag=OWASP_CRS"

Expected behavior

SecActions rules should be disableable via a ctl action, just like SecRules.

Server:

• ModSecurity version (and connector): libmodsecurity 3.0.12 and ModSec-Nginx 1.0.3
• WebServer: Nginx 1.18.0
• OS: Ubuntu 22.04

Rule Set:

• CRSv4 RC-2

Additional context

This issue currently affects some CRS plugins such as Nextcloud or WordPress, if you wish to use them in a reverse proxy and want to selectively enable/disable the plugins for certain domains.

Start by reproducing the issue with the provided SecRule and SecAction configuration in libmodsecurity3, using the stated Nginx and CRS setup. Trace how ctl:ruleRemoveById and ctl:ruleRemoveByTag are applied to SecRules versus SecActions; done means a SecAction can be disabled through ctl in the same way as a SecRule, without disabling the targeted CRS rules.