Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/discriminator/abuseipdb.go

@@ -1,7 +1,7 @@
 package discriminator
 
-// The heuristic abuseipdb. It reads SWW_ABUSEIPDB_KEY,
-// SWW_ABUSEIPDB_MIN_SCORE and SWW_REPUTATION_ACTION.
+// The heuristic abuseipdb. It reads SWW_WAF_ABUSEIPDB_KEY,
+// SWW_WAF_ABUSEIPDB_MIN_SCORE and SWW_WAF_REPUTATION_ACTION.
 
 import (
 	"context"
@@ -16,12 +16,12 @@ import (
 
 // abuseIPDB adds the tag abuseipdb and notes AbuseIPDB, as noteHit does, with
 // the score, when its score of the client is a hit, and refuses the request
-// when SWW_REPUTATION_ACTION is deny, as dnsbl does for a zone. While
-// SWW_ABUSEIPDB_KEY is unset it does nothing. A client without a score is
+// when SWW_WAF_REPUTATION_ACTION is deny, as dnsbl does for a zone. While
+// SWW_WAF_ABUSEIPDB_KEY is unset it does nothing. A client without a score is
 // checked in the background, by the request's address, if its history counts
 // an offence, and the request does not wait for the answer. The score is then
 // used for each address of the client. Its figures are the score and
-// SWW_ABUSEIPDB_MIN_SCORE.
+// SWW_WAF_ABUSEIPDB_MIN_SCORE.
 type abuseIPDB struct{}
 
 func (abuseIPDB) name() string { return "abuseipdb" }
@@ -43,7 +43,7 @@ func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
 	rq.abuseIPDBHit = true
 	rq.addTag(config.AbuseIPDBTag)
 	rq.noteHit(bans.ReputationHit{Source: reputation.AbuseIPDBSource, Score: &score},
-		"scored by AbuseIPDB at or over SWW_ABUSEIPDB_MIN_SCORE")
+		"scored by AbuseIPDB at or over SWW_WAF_ABUSEIPDB_MIN_SCORE")
 
 	if rq.h.config.ReputationAction != deny {
 		return nil