rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

docs/image.md

@@ -1,6 +1,7 @@
 # What the image holds
 
-The contents of the `smallwebwaf` image, and how each part is pinned.
+The contents of the `smallwebwaf` image, and how each part is pinned. The image
+runs `rproxy` by default, or `servewaf` with `SMALLWEBWAF_COMMAND=servewaf`.
 "Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
 is pinned that way.
 
@@ -18,8 +19,9 @@ is pinned that way.
 - The `smallwebwaf` binary, and the user `smallwebwaf` (uid and gid 65532).
 - The service directory `/etc/service/smallwebwaf`, with the `run` script
   `share/smallwebwaf.run`.
-- `/var/lib/smallwebwaf` for the state files, and `/etc/smallwebwaf/rules.d`
-  with the default rule file `share/rules.d/00-default.rules`.
+- `/var/lib/smallwebwaf` for `servewaf`'s state files, and
+  `/etc/smallwebwaf/rules.d` with the default rule file
+  `share/rules.d/00-default.rules`.
 - `EXPOSE 8080`, and the `HEALTHCHECK` that runs `smallwebwaf healthcheck`.
 
 ## Pins