I too have been faced with rather demanding security injection testing on EE (and non EE) sites so I can fee lyour pain, and speak from some experiance.
First the direct answer to your question. There isn't a directory/list, however you can read and modify the security library here (it uses the CodeIgniter Lib, whcih is assimilated by the EE_Security file) :...
Word of Warning
First let me warn you the below technique involved modifying core files, and is not recommended. If you update EE you may overwrite these chnages!
What you want to do is add tags to the EE Typography class. /system/expressionengine/libraries/EE_Typeography.php.
To add UL, OL and LI open this file, look to lines 143 to 165 (ish), you will ...
I just tested this (really quickly) on one of my sites running 2.8.1 and couldn't exploit the exp_csrf cookie in the way described by your report.
However I could do it on your site using the exact same method. So perhaps a simple update to 2.8.1 or higher will fix the problem for you.
UPDATE (from my comment)
The site I tested on had no search form, ...
I believe what changed is that EE now defaults to requiring session IDs in the control panel URLs. (That's the S=e8a181fc77af1b35e47193c0e0b27a15 part you see.)
You can disable this at Admin -> Security and Privacy -> Security and Sessions, changing the Control Panel session type to Cookies Only.
Or, you can just add the session ID into your URLs, which is ...
Sounds like a perfect user case for krea elements: http://devot-ee.com/add-ons/content-elements
You could have a 'script' field as a separate entity and arrange it before/after any other fields required.