SPEC: the one place for behaviour and reasons; docs/ as lookup lists only

docs/core-rule-set.md, docs/lookup.md, docs/reputation.md and docs/bans.md
restated the spec and are folded back into it and removed. The remaining
docs files hold only lists: settings with their defaults and value forms,
the request log's fields, the metrics, the endpoints, the state files and
their contents, the rule file format and default file, the alert events
and messages, the image's contents and pins, and the gitea notes. Every
behaviour each of them held moves to the spec, said once. The settings
groups have the same names in both files. Stale comments in
internal/state and script/example-app point at the right places.

Model: fable-5-1

internal/remotelog/remotelog.go

@@ -1,9 +1,8 @@
 // Package remotelog sends the lines smallwebwaf writes on stdout to the
 // remote log endpoint, SWWAF_LOG_REMOTE_URL, as the "Request log" section
-// of SPEC.md requires and "Sending the log to a syslog server" in
-// docs/request-log.md describes: each line as the message of an RFC 5424
-// syslog record, over UDP, TCP or TLS. Lines wait in a bounded buffer, so
-// a slow or unreachable endpoint never holds up a request or stdout.
+// of SPEC.md describes: each line as the message of an RFC 5424 syslog
+// record, over UDP, TCP or TLS. Lines wait in a bounded buffer, so a slow
+// or unreachable endpoint never holds up a request or stdout.
 package remotelog
 
 import (