rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.
Partially verified: make example-app and make gitea-requests never built the image, as Ubuntu's snapshot service answered 5xx.

Model: opus-5-5

internal/proxy/crowdsec_test.go

@@ -84,7 +84,7 @@ func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(t *testi
 
 	// The ban and the hit are counted, and the list has the metrics of any
 	// list fetched from a URL.
-	metrics := s.scrape(unplaced)
+	metrics := s.scrape()
 	labels := `{instance="` + alertInstance + `",source="` + decisionsURL + `"}`
 
 	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="crowdsec",`+