rproxy: circuit breaker for asks to waf (closes #392)

Five failed asks to waf within five seconds open the breaker. An ask
fails when it gets no answer in time, slow answers included, or an
answer rproxy cannot pass on. Every usable answer clears the failures
and closes the breaker. While open, a request takes
SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION without asking waf, except
one ask a second. SPEC.md describes it.

The sww test that stops and restarts waf now waits for the breaker to
close before it expects the ban again.

Model: opus-5-5

internal/sww/rproxy_test.go

@@ -260,7 +260,17 @@ func TestTheSiteAnswersWhileWAFIsStoppedAndStartedAgain(t *testing.T) {
 		stop()
 	}()
 
-	wantStatus(t, site+"/", placed, http.StatusForbidden)
+	// The visitor's asks have opened rproxy's circuit breaker, which lets one
+	// request a second ask until one is answered.
+	deadline := time.Now().Add(waitLimit)
+	for statusFrom(t, site+"/", placed) != http.StatusForbidden {
+		if time.Now().After(deadline) {
+			t.Fatalf("request from %s: never answered %d", placed,
+				http.StatusForbidden)
+		}
+
+		time.Sleep(pollInterval)
+	}
 
 	close(visitorStop)
 	<-visitorDone