servewaf answers rproxy's question about each request and takes its report (closes #170)

`smallwebwaf servewaf` runs today's checks on the visitor's request each
question carries, answers rproxy, and passes nothing to an app. rproxy reports
every request servewaf answered. A report counts an allowed request's bytes and
writes servewaf's second log line. The table holds a copy of what a report
needs, never the request, so a report cannot reach a request being handled.

Judgement call: a question's body is read before any check; over 64 KiB gets 400.
Judgement call: a report's bytes and durations have ceilings, so they cannot overflow.
Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close.

Model: opus-5-5

docs/alerts.md

@@ -78,6 +78,9 @@ on one line:
 
 - `instance`: `SWWAF_INSTANCE_NAME`. `time`: when the alert was raised. `event`:
   one of the events above.
+- `host`: the site of the request that raised the alert. Only `servewaf` sends
+  this field, since it serves many sites, and not for `source_failure`,
+  `file_error` and `summary`.
 - `client`: the address whose request raised the alert. Empty for
   `source_failure`, `file_error` and `summary`.
 - `netblock`: empty for `source_failure`, `file_error` and `summary`; otherwise
@@ -110,7 +113,7 @@ Slack and ntfy get a message with a title and a text. The title is the instance
 and the event, such as `fsn1app1/gitea: ban`. The text is the `reason`, then one
 line for each of these that the alert has:
 
-- the client, the netblock and the country;
+- the host, the client, the netblock and the country;
 - the file, the source, the error and the mode from `detail`;
 - the suppressed repeats, if any.