Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/request.go

@@ -90,7 +90,10 @@ type request struct {
 // with what is known of the request. isQuestion says whether r is a question,
 // whose headers give the request's id and scheme.
 func (h *handler) startRequest(
-	w http.ResponseWriter, r *http.Request, client, peer netip.Addr, isQuestion bool,
+	w http.ResponseWriter,
+	r *http.Request,
+	client, peer netip.Addr,
+	isQuestion bool,
 ) *request {
 	h.metrics.RequestStarted()
 
@@ -102,23 +105,26 @@ func (h *handler) startRequest(
 			client:     client,
 			requestURI: r.URL.RequestURI(),
 			line: requestlog.Line{
-				Time:             requestlog.FormatTime(start),
-				Instance:         h.config.InstanceName,
-				ClientIP:         client.String(),
-				Method:           r.Method,
-				Scheme:           scheme(r, isQuestion),
-				Host:             r.Host,
-				Path:             rules.Path(r),
-				Query:            r.URL.RawQuery,
-				Protocol:         r.Proto,
-				Referer:          r.Referer(),
-				UserAgent:        r.UserAgent(),
-				RequestID:        requestID(r, isQuestion),
-				PeerIP:           peer.String(),
-				ForwardedFor:     strings.Join(forwardedFor, ", "),
-				ClientGroup:      h.clientGroup(client).String(),
-				ContentType:      r.Header.Get("Content-Type"),
-				RequestHeaders:   requestHeaders(r, h.config.LogRequestHeaders),
+				Time:         requestlog.FormatTime(start),
+				Instance:     h.config.InstanceName,
+				ClientIP:     client.String(),
+				Method:       r.Method,
+				Scheme:       scheme(r, isQuestion),
+				Host:         r.Host,
+				Path:         rules.Path(r),
+				Query:        r.URL.RawQuery,
+				Protocol:     r.Proto,
+				Referer:      r.Referer(),
+				UserAgent:    r.UserAgent(),
+				RequestID:    requestID(r, isQuestion),
+				PeerIP:       peer.String(),
+				ForwardedFor: strings.Join(forwardedFor, ", "),
+				ClientGroup:  h.clientGroup(client).String(),
+				ContentType:  r.Header.Get("Content-Type"),
+				RequestHeaders: requestHeaders(
+					r,
+					h.config.LogRequestHeaders,
+				),
 				HasAuthorization: len(r.Header.Values("Authorization")) > 0,
 				HasCookie:        len(r.Header.Values("Cookie")) > 0,
 				Action:           requestlog.ActionForward,
@@ -191,7 +197,10 @@ func (rq *request) check(ctx context.Context) *refusal {
 		action == requestlog.ActionBlockedByCoreRuleSet:
 		return &refusal{status: http.StatusForbidden, action: action}
 	case action == requestlog.ActionRequestHeaderTooLarge:
-		return &refusal{status: http.StatusRequestHeaderFieldsTooLarge, action: action}
+		return &refusal{
+			status: http.StatusRequestHeaderFieldsTooLarge,
+			action: action,
+		}
 	default:
 		return rq.banResponse(action)
 	}
@@ -281,7 +290,11 @@ func (rq *request) finish() {
 func (rq *request) writeLine() {
 	err := requestlog.Write(rq.h.requestLog, &rq.line)
 	if err != nil {
-		rq.h.processLog.Error("writing the request log failed", "error", err.Error())
+		rq.h.processLog.Error(
+			"writing the request log failed",
+			"error",
+			err.Error(),
+		)
 	}
 }
 
@@ -315,7 +328,11 @@ func (rq *request) addToHistory() {
 		BlockedByCoreRuleSet: rq.blockedByCoreRuleSet,
 	}
 
-	rq.h.limiter.AddToHistory(rq.h.clientGroup(rq.client), rq.h.now(), request)
+	rq.h.limiter.AddToHistory(
+		rq.h.clientGroup(rq.client),
+		rq.h.now(),
+		request,
+	)
 	rq.h.metrics.Offences(request)
 
 	answer, found := rq.answerAtTheEnd()
@@ -353,8 +370,10 @@ func (rq *request) countAnomalies() {
 func anomalyThresholdsSet(cfg *config.Config) bool {
 	off := anomaly.Thresholds{}
 
-	return cfg.AnomalyClient != off || cfg.AnomalyNet != off || cfg.AnomalyASN != off ||
-		cfg.AnomalyTotal != off || cfg.AnomalyWatch != off
+	return cfg.AnomalyClient != off || cfg.AnomalyNet != off ||
+		cfg.AnomalyASN != off ||
+		cfg.AnomalyTotal != off ||
+		cfg.AnomalyWatch != off
 }
 
 // answerAtTheEnd returns, for a client that was looked up, the lookup's