Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/discriminator/requestlog_test.go

@@ -19,7 +19,7 @@ import (
 const (
 	// requestIDHeader carries the request's id.
 	requestIDHeader = "X-Request-ID"
-	// instance is the SWW_INSTANCE_NAME a test sets.
+	// instance is the SWW_WAF_INSTANCE_NAME a test sets.
 	instance = "fsn1app1/blog"
 	// ipv6Client is a client on IPv6, and ipv6Group the netblock the rate
 	// limits count it as.
@@ -196,7 +196,7 @@ func TestHasAuthorizationAndHasCookieEachComeFromTheirOwnHeader(t *testing.T) {
 func TestTimingsAreInOrder(t *testing.T) {
 	t.Parallel()
 
-	const denied = "192.0.2.50" // in SWW_DENY_NETS
+	const denied = "192.0.2.50" // in SWW_WAF_DENY_NETS
 
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		// The pause sets the times apart; a hold-up of the test only lengthens