rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171)

`smallwebwaf rproxy` reads the first 64 KiB of each body, asks servewaf over
HTTP/1.1, and passes what servewaf allows to the app within its limits. Any
other answer goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION
decides only when servewaf cannot be connected to, does not answer at all, or
does not answer within SWRP_TIMEOUT_MS. A method SPEC.md does not list gets 405.

Duplication: internal/rproxy copies passing-on code from internal/proxy until
#172 removes the originals.
Rule suppressed: gosec G704 and G705; gosec at
internal/smallwebwaf/rproxy_test.go:431; tagliatelle at
internal/requestlog/requestlog.go:203; paralleltest on one test.
Judgement call: an answer over 1 MiB, or with a status below 200, gets 502.
Judgement call: every target not starting with one / gets 400.

Model: opus-5-5

cmd/smallwebwaf/main.go

@@ -1,6 +1,7 @@
 // Command smallwebwaf is a web application firewall for one app: it runs
 // between traefik and the app and passes requests through within its limits,
-// or, as `smallwebwaf servewaf`, answers rproxy's questions about them.
+// or, as `smallwebwaf servewaf`, answers rproxy's questions about them, or, as
+// `smallwebwaf rproxy`, is the reverse proxy that asks those questions.
 // Everything it does is in internal/smallwebwaf.
 package main