rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.
Partially verified: make example-app and make gitea-requests never built the image, as Ubuntu's snapshot service answered 5xx.

Model: opus-5-5

share/smallwebwaf.run

@@ -2,22 +2,38 @@
 set -euo pipefail
 
 # runit's run script for smallwebwaf, run again whenever smallwebwaf
-# exits; the wait spaces out the restarts. The state directory and every
-# file in it are given to the smallwebwaf user, so that a volume mounted
-# there needs no change of owner; chown -R changes a symbolic link itself,
-# never what it points to. When SWWAF_STATE_DIR, in either form, cannot be
-# read or is not the absolute path of a directory, no owner is changed,
-# and smallwebwaf starts and stops with a message naming the setting. A
-# change of owner that fails, as on a volume mounted read-only, does not
-# end the script either: smallwebwaf reports a directory it cannot write.
+# exits; the wait spaces out the restarts. SMALLWEBWAF_COMMAND names the
+# command to run: rproxy when it is unset or empty, or servewaf. With any
+# other value the script starts nothing and stops with a message naming it.
 # exec, so that the signal `sv stop` sends reaches smallwebwaf itself.
 main() {
     sleep 1
+    local command="${SMALLWEBWAF_COMMAND:-rproxy}"
+    case "$command" in
+        rproxy) ;;
+        servewaf) give_state_dir_to_smallwebwaf ;;
+        *)
+            printf 'SMALLWEBWAF_COMMAND: "%s" is not rproxy or servewaf\n' \
+                "$command" >&2
+            exit 1
+            ;;
+    esac
+    exec chpst -u smallwebwaf:smallwebwaf /usr/local/bin/smallwebwaf "$command"
+}
+
+# give_state_dir_to_smallwebwaf gives the state directory and every file in
+# it to the smallwebwaf user, so that a volume mounted there needs no change
+# of owner; chown -R changes a symbolic link itself, never what it points
+# to. When SWWAF_STATE_DIR, in either form, cannot be read or is not the
+# absolute path of a directory, no owner is changed, and servewaf starts and
+# stops with a message naming the setting. A change of owner that fails, as
+# on a volume mounted read-only, does not end the script either: servewaf
+# reports a directory it cannot write.
+give_state_dir_to_smallwebwaf() {
     local dir
     if dir="$(state_dir)" && [[ "$dir" == /* && -d "$dir" ]]; then
         chown -R smallwebwaf:smallwebwaf "$dir" || true
     fi
-    exec chpst -u smallwebwaf:smallwebwaf /usr/local/bin/smallwebwaf
 }
 
 # state_dir prints SWWAF_STATE_DIR, /var/lib/smallwebwaf when it is unset,