Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/coreruleset/vaultwarden_test.go

@@ -68,18 +68,53 @@ var vaultwardenNameFields = []vaultwardenField{
 		http.MethodPost, vaultwardenFinishSignUp, jsonBody,
 		`{"email":"alice@example.com","masterPasswordHint":"VALUE"}`,
 	},
-	{http.MethodPut, vaultwardenProfile, jsonBody, `{"name":"VALUE","culture":"en-US"}`},
-	{http.MethodPost, vaultwardenPassword, jsonBody, `{"masterPasswordHint":"VALUE"}`},
+	{
+		http.MethodPut,
+		vaultwardenProfile,
+		jsonBody,
+		`{"name":"VALUE","culture":"en-US"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenPassword,
+		jsonBody,
+		`{"masterPasswordHint":"VALUE"}`,
+	},
 	{
 		http.MethodPost, "/api/organizations", jsonBody,
 		`{"name":"VALUE","billingEmail":"billing@example.com"}`,
 	},
 	{http.MethodPut, vaultwardenOrganization, jsonBody, `{"name":"VALUE"}`},
-	{http.MethodPost, vaultwardenOrganization + "/groups", jsonBody, `{"name":"VALUE"}`},
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"invitation_org_name":"VALUE"}`},
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"smtp_from_name":"VALUE"}`},
-	{http.MethodPost, vaultwardenSecurityKey, jsonBody, `{"id":1,"name":"VALUE"}`},
-	{http.MethodPut, vaultwardenSecurityKey, jsonBody, `{"id":1,"name":"VALUE"}`},
+	{
+		http.MethodPost,
+		vaultwardenOrganization + "/groups",
+		jsonBody,
+		`{"name":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"invitation_org_name":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"smtp_from_name":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSecurityKey,
+		jsonBody,
+		`{"id":1,"name":"VALUE"}`,
+	},
+	{
+		http.MethodPut,
+		vaultwardenSecurityKey,
+		jsonBody,
+		`{"id":1,"name":"VALUE"}`,
+	},
 }
 
 // vaultwardenAddressFields hold every field of a body that skips 930120,
@@ -91,8 +126,18 @@ var vaultwardenAddressFields = []vaultwardenField{
 		http.MethodPost, "/identity/connect/token", formData,
 		"grant_type=password&username=VALUE&password=example&scope=api+offline_access",
 	},
-	{http.MethodPost, "/identity/accounts/prelogin/password", jsonBody, vaultwardenEmail},
-	{http.MethodPost, vaultwardenSignUp, jsonBody, `{"email":"VALUE","name":"Alice"}`},
+	{
+		http.MethodPost,
+		"/identity/accounts/prelogin/password",
+		jsonBody,
+		vaultwardenEmail,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSignUp,
+		jsonBody,
+		`{"email":"VALUE","name":"Alice"}`,
+	},
 	{http.MethodPost, vaultwardenFinishSignUp, jsonBody, vaultwardenEmail},
 	{
 		http.MethodPost, vaultwardenFinishSignUp, jsonBody,
@@ -106,34 +151,84 @@ var vaultwardenAddressFields = []vaultwardenField{
 		http.MethodPost, vaultwardenPassword, jsonBody,
 		`{"authenticationData":{"salt":"VALUE"}}`,
 	},
-	{http.MethodPost, vaultwardenPassword, jsonBody, `{"unlockData":{"salt":"VALUE"}}`},
+	{
+		http.MethodPost,
+		vaultwardenPassword,
+		jsonBody,
+		`{"unlockData":{"salt":"VALUE"}}`,
+	},
 	{
 		http.MethodPost, "/api/accounts/key-management/rotate-user-account-keys", jsonBody,
 		`{"accountUnlockData":{"masterPasswordUnlockData":{"email":"VALUE"}}}`,
 	},
-	{http.MethodPost, "/api/accounts/password-hint", jsonBody, vaultwardenEmail},
-	{http.MethodPost, "/api/accounts/email-token", jsonBody, `{"newEmail":"VALUE"}`},
+	{
+		http.MethodPost,
+		"/api/accounts/password-hint",
+		jsonBody,
+		vaultwardenEmail,
+	},
+	{
+		http.MethodPost,
+		"/api/accounts/email-token",
+		jsonBody,
+		`{"newEmail":"VALUE"}`,
+	},
 	{
 		http.MethodPost, "/api/emergency-access/invite", jsonBody,
 		`{"email":"VALUE","type":0}`,
 	},
-	{http.MethodPut, vaultwardenOrganization, jsonBody, `{"billingEmail":"VALUE"}`},
+	{
+		http.MethodPut,
+		vaultwardenOrganization,
+		jsonBody,
+		`{"billingEmail":"VALUE"}`,
+	},
 	{
 		http.MethodPost, vaultwardenOrganization + "/users/invite", jsonBody,
 		`{"emails":["alice@example.com","VALUE"],"type":2}`,
 	},
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"smtp_from":"VALUE"}`},
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"smtp_username":"VALUE"}`},
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"org_creation_users":"VALUE"}`},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"smtp_from":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"smtp_username":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"org_creation_users":"VALUE"}`,
+	},
 	{http.MethodPost, "/admin/invite", jsonBody, vaultwardenEmail},
 	{http.MethodPost, "/admin/test/smtp", jsonBody, vaultwardenEmail},
-	{http.MethodPost, "/api/two-factor/send-email-login", jsonBody, vaultwardenEmail},
-	{http.MethodPost, "/api/two-factor/send-email", jsonBody, vaultwardenEmail},
+	{
+		http.MethodPost,
+		"/api/two-factor/send-email-login",
+		jsonBody,
+		vaultwardenEmail,
+	},
+	{
+		http.MethodPost,
+		"/api/two-factor/send-email",
+		jsonBody,
+		vaultwardenEmail,
+	},
 	{
 		http.MethodPut, "/api/two-factor/email", jsonBody,
 		`{"email":"VALUE","token":"123456"}`,
 	},
-	{http.MethodPost, "/api/auth-requests", jsonBody, `{"email":"VALUE","type":0}`},
+	{
+		http.MethodPost,
+		"/api/auth-requests",
+		jsonBody,
+		`{"email":"VALUE","type":0}`,
+	},
 }
 
 // vaultwardenBreachReport is the data breach report, which sends an address
@@ -256,7 +351,12 @@ func TestVaultwardenExclusionsAreNarrow(t *testing.T) {
 
 		got, _ := inspectBody(t, crs, r, refused.body)
 		if got.Score < vaultwardenThreshold {
-			t.Errorf("POST %s %s let through: %+v", refused.target, refused.body, got)
+			t.Errorf(
+				"POST %s %s let through: %+v",
+				refused.target,
+				refused.body,
+				got,
+			)
 		}
 	}
 
@@ -292,7 +392,8 @@ func TestVaultwardenAdminTokenPasses(t *testing.T) {
 func masterPasswordHashes(count int) []string {
 	const size, seed = 32, 288
 
-	random := rand.New(rand.NewPCG(seed, seed)) //nolint:gosec // a fixed sample
+	//nolint:gosec // a fixed sample
+	random := rand.New(rand.NewPCG(seed, seed))
 
 	hashes := make([]string, count)
 
@@ -340,8 +441,15 @@ func TestVaultwardenMasterPasswordHashesPass(t *testing.T) {
 			t.Fatalf("a body of %d bytes is cut at bodyLimit", len(body))
 		}
 
-		if got, _ := inspectBody(t, crs, sent.r, body); len(got.RuleIDs) != 0 {
-			t.Errorf("POST %s %v set off rules: %+v", sent.r.target, sent.names, got)
+		if got, _ := inspectBody(t, crs, sent.r, body); len(
+			got.RuleIDs,
+		) != 0 {
+			t.Errorf(
+				"POST %s %v set off rules: %+v",
+				sent.r.target,
+				sent.names,
+				got,
+			)
 		}
 	}
 }
@@ -350,7 +458,9 @@ func TestVaultwardenEncryptedFileNamesPassOnlyOnUploads(t *testing.T) {
 	t.Parallel()
 
 	crs := readingBodies(t)
-	encrypted := vaultwardenUpload("2.4Hw+ulOz7BLrP+NSaLKhGw==|9nlpuuYHog6rpJ=|XLsf=")
+	encrypted := vaultwardenUpload(
+		"2.4Hw+ulOz7BLrP+NSaLKhGw==|9nlpuuYHog6rpJ=|XLsf=",
+	)
 
 	for _, target := range []string{
 		vaultwardenCipher + "/attachment/ec4c8ed74f6d3c56443a",