To convert those rules to Hiawatha's toolkit could be problematic, because of the E option (the Authorization rule). Hiawatha doesn't have a comparing feature. But besides that, it's a strange rule. A webapplication shouldn't need the Authorization HTTP header. My guess is that Magento wants to know the username of the current user. It should be read from the REMOTE_USER environment variable. So, this looks like bad design from Magento's side.
If we ignore the authorization rule, I guess it will be something like this:
UrlToolkit {
ToolkitID = magento
Match ^/(media|skin|js)/ Return
RequestURI exists Return
Match ^/magento/.* /magento/index.php
}
I haven't tested it, so it probably needs some tweaking.