Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/discriminator/blocklists.go

@@ -1,6 +1,6 @@
 package discriminator
 
-// The heuristic blocklists. It reads SWW_BLOCKLIST_ACTION, and the blocklists
+// The heuristic blocklists. It reads SWW_WAF_BLOCKLIST_ACTION, and the blocklists
 // through the reputation lists.
 
 import (
@@ -11,7 +11,7 @@ import (
 )
 
 // blocklists notes the blocklists that list the client, as noteListed does,
-// and refuses the request when SWW_BLOCKLIST_ACTION is deny. Being limit, it
+// and refuses the request when SWW_WAF_BLOCKLIST_ACTION is deny. Being limit, it
 // lowers the client's limits instead (see limitPercentages), and being log, it
 // does nothing more. Its figure is the blocklists that list the client.
 type blocklists struct{}
@@ -35,7 +35,7 @@ func (blocklists) check(_ context.Context, rq *request, _ time.Time) *verdict {
 
 // refusedByBlocklists reports whether the heuristic blocklists refuses a
 // client, given listedBy, the blocklists that list it: it does when one lists
-// it and SWW_BLOCKLIST_ACTION is deny.
+// it and SWW_WAF_BLOCKLIST_ACTION is deny.
 func (rq *request) refusedByBlocklists(listedBy []string) bool {
 	return len(listedBy) > 0 && rq.h.config.BlocklistAction == deny
 }