Read every setting through viper (closes #211)

servewaf's and rproxy's settings are read through viper, bound to the same environment variable names as before, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set, as it did. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings tests pass set into a viper instead of a lookup function.

Model: deepseek-v4-pro

SPEC.md

@@ -31,11 +31,11 @@ to them.
   reputation sources, and send alerts.
 - Everything is set by environment variables. The names of `servewaf`'s start
   with `SWWAF_`, and those of `rproxy` with `SWRP_`. The only other inputs are
-  `servewaf`'s files:
-    - the rule files;
-    - the state files;
-    - a lookup database;
-    - a `SWWAF_` setting given as a file;
+  files:
+    - `servewaf`'s rule files;
+    - `servewaf`'s state files;
+    - `servewaf`'s lookup database;
+    - a `SWWAF_` or `SWRP_` setting given as a file;
     - the file `SWWAF_LOG_REMOTE_TLS_CA_FILE` names;
     - the file `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE` names.
 
@@ -322,14 +322,13 @@ Conventions:
     No other setting can be switched off with `off`.
 
 - A list set to an empty value is an empty list, and replaces the default.
-- Any `SWWAF_` setting can be read from a file instead, for secrets and long
-  lists: `SWWAF_ADMIN_TOKEN_FILE` names the file that holds `SWWAF_ADMIN_TOKEN`.
-  The file's contents are the value, less one newline at the end, and are
-  checked as the value itself would be. Setting both forms stops the start, and
-  so does naming a file that cannot be read. `SWWAF_LOG_REMOTE_TLS_CA_FILE` and
-  `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE` already hold a file name, so they have
-  no `_FILE` form. No `SWRP_` setting has one, since `rproxy` never touches
-  disk.
+- Any `SWWAF_` or `SWRP_` setting can be read from a file instead, for secrets
+  and long lists: `SWWAF_ADMIN_TOKEN_FILE` names the file that holds
+  `SWWAF_ADMIN_TOKEN`. The file's contents are the value, less one newline at
+  the end, and are checked as the value itself would be. Setting both forms
+  stops the start, and so does naming a file that cannot be read.
+  `SWWAF_LOG_REMOTE_TLS_CA_FILE` and `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE`
+  already hold a file name, so they have no `_FILE` form.
 - Settings, files included, are read once at start. Changing one means
   restarting the container. The files `servewaf` watches while it runs are its
   state files, its rule files and the lookup database.