Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/waf/ratelimits_test.go

@@ -10,7 +10,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// minute is the window of SWW_RATE_LIMIT_PER_MINUTE, as a log line's
+// minute is the window of SWW_WAF_RATE_LIMIT_PER_MINUTE, as a log line's
 // limit_hit names it.
 const minute = "minute"
 
@@ -107,7 +107,7 @@ func TestRateLimitRefusalNamesItsHeuristicWindowCountAndLimit(t *testing.T) {
 func TestIPv6GroupPrefixSetsTheClientTheLimitsCount(t *testing.T) {
 	t.Parallel()
 
-	// With SWW_IPV6_GROUP_PREFIX at 48, the first two addresses, in two
+	// With SWW_WAF_IPV6_GROUP_PREFIX at 48, the first two addresses, in two
 	// /64s of one /48, are one client, and the second's request breaks the
 	// limit; the third, in the next /48, is another client.
 	const (
@@ -150,7 +150,7 @@ func TestIPv6GroupPrefixSetsTheClientTheLimitsCount(t *testing.T) {
 func TestRateLimitExemptPathsAreNeitherCountedNorRefused(t *testing.T) {
 	t.Parallel()
 
-	const denied = "192.0.2.50" // in SWW_DENY_NETS
+	const denied = "192.0.2.50" // in SWW_WAF_DENY_NETS
 
 	geojsURL, _ := startGeoJS(t)
 	s, _, server := startWithClock(t, geojsURL, map[string]string{
@@ -199,7 +199,7 @@ func TestRateLimitExemptPathsAreNeitherCountedNorRefused(t *testing.T) {
 	s.request(client, "/assets", http.StatusForbidden,
 		requestlog.ActionClientIsRateLimited)
 
-	// A ban, SWW_DENY_NETS and SWW_TAG_DENY still refuse a path under a
+	// A ban, SWW_WAF_DENY_NETS and SWW_WAF_TAG_DENY still refuse a path under a
 	// prefix.
 	s.request(client, "/assets/app.js", http.StatusForbidden,
 		requestlog.ActionTemporarilyBanned)