SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

gitea's fixes (its parameters, its cookies and gitea.conf) now apply
only to a hostname SWW_APPS lists gitea for, or to every hostname while
it is unset. Each app's fixes are one .conf file, whose first rule skips
the rest unless Inspect sets tx.app_<name>, and one entry in apps.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

docs/settings.md

@@ -198,6 +198,24 @@ between the two (see "The image's command" below).
   a range. So does a directive that removes or changes rules as the file loads,
   such as `SecRuleRemoveById`, since none of the Core Rule Set's rules is loaded
   yet. It has no `_FILE` form.
+- `SWW_APPS` (default unset): the apps each hostname serves. A request gets the
+  fixes of its hostname's apps only (see "Attack detection" in
+  [`SPEC.md`](../SPEC.md)).
+    - Entries are separated by semicolons. Each is a hostname, a colon, then one
+      or more apps separated by commas, for example
+      `git.example.com:gitea;code.example.com:gitea`.
+    - `gitea` is the only app supported.
+    - The request's `Host` is matched by exact name, without its port and
+      without regard to case. There are no wildcards.
+    - A hostname not listed gets no app's fixes, so every rule checks it in
+      full. Set empty, it lists no hostname.
+    - Unset, every app's fixes apply to every hostname.
+    - Any of these mistakes stops the start:
+        - an unknown app;
+        - a hostname that is not a DNS name, such as `*.example.com`;
+        - a hostname listed twice;
+        - an app listed twice for one hostname;
+        - an entry without a colon.
 - `SWW_ERROR_BURST_THRESHOLD` (default `30`): the most refusals of one client in
   a minute (see "Attack detection" in `SPEC.md`). A count or `off`.