rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171)

`smallwebwaf rproxy` reads the first 64 KiB of each body, asks servewaf over
HTTP/1.1, and passes what servewaf allows to the app within its limits. Any
other answer goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION
decides only when servewaf cannot be connected to, does not answer at all, or
does not answer within SWRP_TIMEOUT_MS. A method SPEC.md does not list gets 405.

Duplication: internal/rproxy copies passing-on code from internal/proxy until
#172 removes the originals.
Rule suppressed: gosec G704 and G705; gosec at
internal/smallwebwaf/rproxy_test.go:431; tagliatelle at
internal/requestlog/requestlog.go:203; paralleltest on one test.
Judgement call: an answer over 1 MiB, or with a status below 200, gets 502.
Judgement call: every target not starting with one / gets 400.

Model: opus-5-5

docs/settings.md

@@ -343,11 +343,15 @@ A few limits are fixed rather than settings:
 - `servewaf` holds at most 10,000 answered requests awaiting their reports;
 - `servewaf` refuses a request with more than 50 cookies or more than 100 header
   fields (see "Answering in time" under "`servewaf`" in
-  [`SPEC.md`](../SPEC.md)).
+  [`SPEC.md`](../SPEC.md));
+- `rproxy` takes a request line and headers of at most 32 KiB, and closes a
+  kept-open connection idle for 120 seconds;
+- `rproxy` reads at most 1 MiB of the body of `servewaf`'s answer, and answers
+  `502` to a longer one.
 
 ## `servewaf`
 
-`smallwebwaf servewaf` uses every setting here but these, which it ignores:
+`smallwebwaf servewaf` uses every `SWWAF_` setting but these, which it ignores:
 
 - `SWWAF_UPSTREAM_URL` and `SWWAF_TRUSTED_PROXIES`;
 - the five timeouts under "Size and time limits";
@@ -367,3 +371,39 @@ Keep it well under `rproxy`'s `SWRP_TIMEOUT_MS`, as the default is. No question
 waits for `SWWAF_REPUTATION_TIMEOUT`, since the DNS blocklists and AbuseIPDB are
 asked in the background (see "Answering in time" under "`servewaf`" in
 [`SPEC.md`](../SPEC.md)).
+
+## `rproxy`
+
+`smallwebwaf rproxy` reads the settings below and no others, and nothing else
+reads them. They are read once at start, and an invalid value stops the start.
+None can be given as a file, since `rproxy` never touches disk. "`rproxy`" in
+[`SPEC.md`](../SPEC.md) says what they do.
+
+A time here is a whole number of milliseconds above zero, such as `2000`.
+
+- `SWRP_WAF_BACKEND` (required, no default): `servewaf`'s URL. An `http` or
+  `https` URL with a host and an optional port, and nothing more. `rproxy`
+  speaks HTTP/1.1 to it.
+- `SWRP_TIMEOUT_MS` (default `2000`): how long `rproxy` waits for `servewaf`'s
+  answer, to a question and to a report. A time; never `off`.
+- `SWRP_DEFAULT_DISPOSITION` (default `allow`): what is done with a request when
+  `servewaf` cannot be connected to, does not answer at all, or does not answer
+  within `SWRP_TIMEOUT_MS`. `allow` passes it to the app, and `deny` answers
+  `503`. It does not apply to an answer `servewaf` gives, such as an error.
+- `SWRP_MAX_REQUEST_SIZE` (default `100M`): the largest request body. A size or
+  `off`.
+- `SWRP_MAX_RESPONSE_SIZE` (default `1G`): the largest response body. A size or
+  `off`.
+- `SWRP_MAX_REQUEST_TIME_MS` (default `60000`): how long the visitor may take to
+  send its request line and headers. It then also bounds, from the end of the
+  headers, the time until the app has been sent the whole request. A time or
+  `off`.
+- `SWRP_MAX_RESPONSE_TIME_MS` (default `1800000`): how long the answer may take,
+  from the end of the request to its last byte reaching the visitor. A time or
+  `off`.
+- `SWRP_LISTEN_ADDR` (default `:8080`): where `rproxy` listens, such as `:9000`.
+- `SWRP_UPSTREAM_URL` (default `http://127.0.0.1:8081`): the app. An `http` or
+  `https` URL with a host and an optional port, and nothing more.
+- `SWRP_TRUSTED_PROXIES` (default `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`):
+  the netblocks whose `X-Forwarded-For` is believed. Set but empty, it trusts
+  nothing.