rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

script/run

@@ -1,14 +1,29 @@
 #!/bin/sh
-# script/run: build bin/smallwebwaf with script/build and run it, with
-# the settings in the environment. Unless SWWAF_STATE_DIR is set, the
-# state files go in bin/state, beside the binary, and unless
-# SWWAF_RULES_DIR is set, the rule files are those of share/rules.d,
+# script/run: build bin/smallwebwaf with script/build and run servewaf and
+# rproxy on the host, with the settings in the environment, until rproxy
+# exits or the script is told to stop. rproxy listens on port 8080 unless
+# SWRP_LISTEN_ADDR says otherwise, in front of the app at SWRP_UPSTREAM_URL.
+# servewaf listens on port 8090 unless SWWAF_LISTEN_ADDR says otherwise, and
+# rproxy asks it there unless SWRP_WAF_BACKEND says otherwise. Unless
+# SWWAF_STATE_DIR is set, the state files go in bin/state, beside the binary,
+# and unless SWWAF_RULES_DIR is set, the rule files are those of share/rules.d,
 # which the image ships.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
+SERVEWAF=""
+RPROXY=""
+
+# stop_both: stop what runs, and wait for it, so that servewaf writes its state
+# files.
+stop_both() {
+    trap '' HUP INT TERM
+    kill $SERVEWAF $RPROXY 2>/dev/null || true
+    wait || true
+}
+
 main() {
     "$SCRIPT_DIR/build"
     if [ -z "${SWWAF_STATE_DIR+set}" ]; then
@@ -20,7 +35,18 @@ main() {
         SWWAF_RULES_DIR="$ROOT/share/rules.d"
         export SWWAF_RULES_DIR
     fi
-    exec "$ROOT/bin/smallwebwaf"
+    SWWAF_LISTEN_ADDR="${SWWAF_LISTEN_ADDR:-:8090}"
+    SWRP_WAF_BACKEND="${SWRP_WAF_BACKEND:-http://127.0.0.1:${SWWAF_LISTEN_ADDR##*:}}"
+    export SWWAF_LISTEN_ADDR SWRP_WAF_BACKEND
+
+    trap stop_both EXIT
+    trap 'exit 1' HUP INT TERM
+
+    "$ROOT/bin/smallwebwaf" servewaf &
+    SERVEWAF=$!
+    "$ROOT/bin/smallwebwaf" rproxy &
+    RPROXY=$!
+    wait "$RPROXY"
 }
 
 main "$@"