smallwebwaf starts with SWWAF_STATE_DIR given as a file on a new volume (closes #137)

The run script gave ${SWWAF_STATE_DIR:-/var/lib/smallwebwaf} to the
smallwebwaf user and never read SWWAF_STATE_DIR_FILE, so a new volume
at the directory that file names stayed root's. The run script now
takes the setting from the variable or the file, and changes the owner
only when it is the absolute path of a directory that exists;
otherwise it starts smallwebwaf, which stops with its message naming
the setting. A chown that fails, as on a read-only volume, no longer
ends the run script. script/example-app, and its entry in README.md,
gain two steps: a container on such a volume becomes healthy, and a
missing state directory reaches smallwebwaf's message.

Model: opus-5-5

README.md

@@ -2381,10 +2381,13 @@ so that they run in minimal containers.
   that the health check passes, that a request reaches the app through
   `smallwebwaf`, that a second request in a minute bans the client, that a probe
   for `/.env` bans another client, whose next request makes the ban permanent,
-  that `sv stop` and `docker stop` stop it in order, and that a new container on
-  the same volume still refuses the banned client; then removes the containers,
-  the volume and both images. It needs network access, for nixpkgs' binary
-  cache, and `script/check` does not run it; `make example-app` does.
+  that `sv stop` and `docker stop` stop it in order, that a new container on the
+  same volume still refuses the banned client, that a container with its state
+  files on a new volume mounted at the directory `SWWAF_STATE_DIR_FILE` names
+  becomes healthy, and that one whose `SWWAF_STATE_DIR` does not exist logs
+  `smallwebwaf`'s message about it; then removes the containers, the volumes and
+  both images. It needs network access, for nixpkgs' binary cache, and
+  `script/check` does not run it; `make example-app` does.
 - `script/gitea-requests`: builds the image and runs gitea 1.27.3 behind it,
   with every setting of `smallwebwaf` at its default but `SWWAF_UPSTREAM_URL`,
   which names gitea's container. Of the requests that three of the notes