Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

internal/waf/refusallimit.go

@@ -1,6 +1,6 @@
 package waf
 
-// The heuristic refusal_limit. It reads SWW_WAF_ERROR_BURST_THRESHOLD and
+// The heuristic refusal_limit. It reads SWW_WAF_REFUSALS_LIMIT_PER_MINUTE and
 // SWW_WAF_BAN_RESPONSE.
 
 import (
@@ -14,9 +14,9 @@ import (
 // refusalLimit counts the request once it has been answered, if waf
 // refused it after a rule file match, a trap path or a Core Rule Set match, and
 // in observe mode if enforce mode would have: more than
-// SWW_WAF_ERROR_BURST_THRESHOLD such refusals of the client within a minute break
+// SWW_WAF_REFUSALS_LIMIT_PER_MINUTE such refusals of the client within a minute break
 // a limit, which bans the client. A client in SWW_WAF_ALLOW_NETS, which the
-// heuristics skip, is not counted, and nothing is while the threshold is off.
+// heuristics skip, is not counted, and nothing is while the limit is off.
 // Its figures are the window, the count and the limit.
 type refusalLimit struct{}
 
@@ -28,7 +28,7 @@ func (refusalLimit) check(
 	now time.Time,
 ) *verdict {
 	cfg := rq.h.config
-	if cfg.ErrorBurstThreshold == 0 {
+	if cfg.RefusalsLimitPerMinute == 0 {
 		return nil
 	}
 
@@ -37,7 +37,7 @@ func (refusalLimit) check(
 	}
 
 	hit, over := rq.h.limiter.CountRefusal(rq.h.clientGroup(rq.client), now,
-		cfg.ErrorBurstThreshold)
+		cfg.RefusalsLimitPerMinute)
 	if !over {
 		return nil
 	}