rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

cmd/smallwebwaf/main.go

@@ -1,8 +1,8 @@
-// Command smallwebwaf is a web application firewall for one app: it runs
-// between traefik and the app and passes requests through within its limits,
-// or, as `smallwebwaf servewaf`, answers rproxy's questions about them, or, as
-// `smallwebwaf rproxy`, is the reverse proxy that asks those questions.
-// Everything it does is in internal/smallwebwaf.
+// Command smallwebwaf is a web application firewall. `smallwebwaf rproxy` is
+// the reverse proxy in front of one app, which asks servewaf about each request.
+// `smallwebwaf servewaf` decides, for many sites, and keeps what lasts.
+// `smallwebwaf healthcheck` is the container's health check. Everything it does
+// is in internal/smallwebwaf.
 package main
 
 import (