Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files.

Model: opus-5-5

internal/waf/headerlimits.go

@@ -0,0 +1,71 @@
+package waf
+
+// The heuristic header_limits. It reads no setting: its limits are fixed.
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// The header limits: the most cookies and header fields a request may have
+// when the checks reach the Core Rule Set. Real clients never reach them.
+const (
+	maxCookies      = 50
+	maxHeaderFields = 100
+)
+
+// headerLimits refuses a request over the header limits, with 431. Its figures
+// are the request's header fields and cookies, and the limit of each.
+type headerLimits struct{}
+
+func (headerLimits) name() string { return "header_limits" }
+
+func (headerLimits) check(_ context.Context, rq *request, _ time.Time) *verdict {
+	fields, cookies := rq.headerCounts()
+	if !overHeaderLimits(fields, cookies) {
+		return nil
+	}
+
+	return &verdict{
+		action: requestlog.ActionRequestHeaderTooLarge,
+		figures: map[string]any{
+			"fields": fields, "fields_limit": maxHeaderFields,
+			"cookies": cookies, "cookies_limit": maxCookies,
+		},
+	}
+}
+
+// overHeaderLimits reports whether a request with these counts of header fields
+// and cookies, as headerCounts counts them, is over the header limits: it has
+// more than maxHeaderFields fields or more than maxCookies cookies.
+func overHeaderLimits(fields, cookies int) bool {
+	return fields > maxHeaderFields || cookies > maxCookies
+}
+
+// headerCounts returns the request's header fields, each value of a header sent
+// twice being one, and its cookies, each part of a Cookie header between
+// semicolons being one unless it is empty or only spaces and tabs. The Core
+// Rule Set runs each of its rules on each cookie, so that thousands of small
+// cookies keep it busy for over a second. It trims only spaces and control
+// characters, of which a header value can hold only tabs, so a part of Unicode
+// spaces is a cookie to it.
+func (rq *request) headerCounts() (int, int) {
+	fields, cookies := 0, 0
+
+	for _, values := range rq.in.Header {
+		fields += len(values)
+	}
+
+	for _, value := range rq.in.Header.Values("Cookie") {
+		for part := range strings.SplitSeq(value, ";") {
+			if strings.Trim(part, " \t") != "" {
+				cookies++
+			}
+		}
+	}
+
+	return fields, cookies
+}