Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

internal/waf/bans.go

@@ -81,11 +81,11 @@ func limitFigures(hit ratelimit.Hit) map[string]any {
 
 // countedBytes returns the request's bytes, once it has ended, as the
 // byte limits and the anomaly thresholds count them: the response's body
-// bytes, the request's, or both, as SWW_WAF_BYTES_COUNT says.
+// bytes, the request's, or both, as SWW_WAF_BYTES_COUNTED says.
 func (rq *request) countedBytes() int64 {
 	response, request := rq.out.bytes, rq.requestBytes
 
-	switch rq.h.config.BytesCount {
+	switch rq.h.config.BytesCounted {
 	case "response":
 		return response
 	case "request":
@@ -100,8 +100,8 @@ func (rq *request) countedBytes() int64 {
 // the metrics. status is what the client was sent, or is sent:
 // SWW_WAF_BAN_RESPONSE for a request over a rate limit, what the report says for
 // one whose bytes broke a byte limit, the refusal for one that broke the
-// error burst. The ban's notes give the client's limit percentage for a
-// rate limit or a byte limit; the error burst is not lowered. The ban sets
+// refusal limit. The ban's notes give the client's limit percentage for a
+// rate limit or a byte limit; the refusal limit is not lowered. The ban sets
 // the client's counters back to zero. In observe mode it makes no ban and
 // sets nothing back, and raises the alert for the ban it would have made,
 // if that alert would be sent.