Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/coreruleset/recorded_test.go

@@ -17,8 +17,8 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// appsUnset labels the checks made while SWW_APPS is unset.
-const appsUnset = "SWW_APPS unset"
+// appsUnset labels the checks made while SWW_WAF_APPS is unset.
+const appsUnset = "SWW_WAF_APPS unset"
 
 // giteaRequests returns the recorded ordinary gitea requests in testdata.
 // Each has the Referer of a page that names the same, as a page opened
@@ -53,18 +53,18 @@ func giteaRequests(t *testing.T) []request {
 }
 
 // TestOrdinaryGiteaRequestsPass checks gitea's recorded requests with
-// SWW_APPS unset, and on giteaHost while SWW_APPS lists only gitea for it.
+// SWW_WAF_APPS unset, and on giteaHost while SWW_WAF_APPS lists only gitea for it.
 func TestOrdinaryGiteaRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	requests := giteaRequests(t)
 	giteaOnly := map[string][]string{giteaHost: {gitea}}
 
 	for apps, crs := range map[string]*coreruleset.CoreRuleSet{
-		appsUnset:                             atDefaults(t),
-		"SWW_APPS=" + giteaHost + ":" + gitea: servingApps(t, giteaOnly),
+		appsUnset: atDefaults(t),
+		"SWW_WAF_APPS=" + giteaHost + ":" + gitea: servingApps(t, giteaOnly),
 	} {
 		for _, r := range requests {
 			got := inspect(t, crs, withHost(r, giteaHost))
@@ -122,24 +122,24 @@ func recordedRequests(t *testing.T, name string) []recordedRequest {
 }
 
 // wantRecordedRequestsPass checks that none of the recorded ordinary
-// requests in the file name in testdata is refused: with SWW_APPS unset, and
+// requests in the file name in testdata is refused: with SWW_WAF_APPS unset, and
 // on the hostname where they were recorded, otherHost for WordPress and
-// example.com for the other apps, while SWW_APPS lists only app for it. Both
+// example.com for the other apps, while SWW_WAF_APPS lists only app for it. Both
 // times, they are checked at the defaults and while bodies are read. A
 // request with neither a body nor a Content-Type header is checked only at
 // the defaults: with neither, the set that reads bodies has nothing more to
 // check. Each request runs as its own parallel subtest for each setting of
-// SWW_APPS.
+// SWW_WAF_APPS.
 func wantRecordedRequestsPass(t *testing.T, name, app string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	requests := recordedRequests(t, name)
 
 	for setting, apps := range map[string]map[string][]string{
-		appsUnset:                    nil,
-		"SWW_APPS lists only " + app: {"example.com": {app}, otherHost: {app}},
+		appsUnset:                        nil,
+		"SWW_WAF_APPS lists only " + app: {"example.com": {app}, otherHost: {app}},
 	} {
 		defaults := servingApps(t, apps)
 		bodies := shared(t, coreruleset.Params{
@@ -204,8 +204,8 @@ func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 }
 
 // TestOrdinaryForgejoRequestsPass checks Forgejo's recorded requests at the
-// defaults only: with SWW_APPS unset, and on example.com, where they were
-// recorded, while SWW_APPS lists only forgejo for it. While bodies are read,
+// defaults only: with SWW_WAF_APPS unset, and on example.com, where they were
+// recorded, while SWW_WAF_APPS lists only forgejo for it. While bodies are read,
 // the Core Rule Set still refuses a new wiki page whose title and text name
 // commands and files, as it does such text in gitea's comments
 // (TestGiteaBodiesTheCoreRuleSetRefuses). The requests that name a file or a
@@ -214,14 +214,14 @@ func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	requests := recordedRequests(t, "forgejo-requests.txt")
 	forgejoOnly := map[string][]string{"example.com": {forgejo}}
 
 	for apps, crs := range map[string]*coreruleset.CoreRuleSet{
-		appsUnset:                      atDefaults(t),
-		"SWW_APPS=example.com:forgejo": servingApps(t, forgejoOnly),
+		appsUnset:                          atDefaults(t),
+		"SWW_WAF_APPS=example.com:forgejo": servingApps(t, forgejoOnly),
 	} {
 		for _, recorded := range requests {
 			r := request{recorded.Method, recorded.Target, recorded.Headers}