Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/discriminator/countries_test.go

@@ -38,7 +38,7 @@ func TestCountryLists(t *testing.T) {
 			[]string{fromKP, unplaced},
 		},
 		{
-			"with a country in SWW_TAG_DENY",
+			"with a country in SWW_WAF_TAG_DENY",
 			map[string]string{tagDeny: denyKP, allowedCountries: "de,fr"},
 			[]string{fromKP, unplaced},
 		},
@@ -100,11 +100,11 @@ func TestCountryRefusalNamesItsHeuristicCountryAndSetting(t *testing.T) {
 
 	line := s.get(fromKP, http.StatusForbidden, requestlog.ActionCountryDenied)
 	wantHeuristic(t, line, "countries",
-		`{"country": "KP", "setting": "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES"}`)
+		`{"country": "KP", "setting": "SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES"}`)
 
 	line = s.get(unplaced, http.StatusForbidden, requestlog.ActionCountryDenied)
 	wantHeuristic(t, line, "countries",
-		`{"country": "", "setting": "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES"}`)
+		`{"country": "", "setting": "SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES"}`)
 }
 
 func TestCountryRefusalKeepsARequestFromTheApp(t *testing.T) {
@@ -262,11 +262,11 @@ func TestExclusiveListRefusesAPrivateAddressUnlessAllowed(t *testing.T) {
 		action    string
 	}{
 		{
-			"not in SWW_ALLOW_NETS", "",
+			"not in SWW_WAF_ALLOW_NETS", "",
 			http.StatusForbidden, requestlog.ActionCountryDenied,
 		},
 		{
-			"in SWW_ALLOW_NETS", "10.0.0.7,fd00::/8",
+			"in SWW_WAF_ALLOW_NETS", "10.0.0.7,fd00::/8",
 			http.StatusOK, requestlog.ActionForward,
 		},
 	} {
@@ -296,7 +296,7 @@ func TestExclusiveListRefusesAPrivateAddressUnlessAllowed(t *testing.T) {
 // startGeoJS starts a stand-in for GeoJS, which places fromDE and fromKP,
 // each in an AS of its own, and no other address. It returns its URL, and
 // what returns the addresses it has been asked about. A test that needs
-// the stand-in to be asked or to answer sets SWW_LOOKUP_TIMEOUT to an
+// the stand-in to be asked or to answer sets SWW_WAF_LOOKUP_TIMEOUT to an
 // hour, whether or not a request waits for the answer: on the default, a
 // hold-up of the test process can abandon the request to the stand-in, and
 // leave the client unknown.