Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/rproxy/limits_test.go

@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/config/configtest"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
 	"sneak.berlin/go/smallwebwaf/internal/waf"
@@ -35,13 +36,9 @@ func TestServerHasTheFixedLimits(t *testing.T) {
 	t.Parallel()
 
 	cfg, err := config.RProxyFromEnvironment(
-		func(name string) (string, bool) {
-			if name == "SWRP_WAF_BACKEND" {
-				return nowhere, true
-			}
-
-			return "", false
-		},
+		configtest.Viper(map[string]string{
+			"SWW_RPROXY_WAF_BACKEND": nowhere,
+		}),
 	)
 	if err != nil {
 		t.Fatalf("settings: %v", err)
@@ -820,7 +817,7 @@ func TestAVisitorGetsAnAnswerWhenTheAppAnswersAsTheTimeRunsOut(
 }
 
 // visitAsTheTimeRunsOut sends requests to an app that answers about as
-// SWRP_MAX_RESPONSE_TIME_MS runs out, and checks that each is answered with the
+// SWW_RPROXY_MAX_RESPONSE_TIME_MS runs out, and checks that each is answered with the
 // app's 200 or a 504.
 func visitAsTheTimeRunsOut(t *testing.T) {
 	t.Helper()