waf: refuse request lines and header lines over 8 KiB first (closes #339)

The header limits now also refuse a request line over 8 KiB with 414
(action request_line_too_long) and a header line over 8 KiB, Host
included, with 431. Like the other header limits they are fixed, run
first and make no ban. One long query string or cookie no longer keeps
the Core Rule Set busy for a third of a second.

Model: opus-5-5

docs/request-log.md

@@ -102,7 +102,8 @@ Every one of these lines has:
       ban this request made or made permanent;
     - `country_denied`, `client_is_rate_limited`, `blocked_by_block_rule` and
       `blocked_by_core_rule_set`: refused by that check;
-    - `request_header_too_large`: over a header limit;
+    - `request_line_too_long`: a request line over the header limits;
+    - `request_header_too_large`: headers over the header limits;
     - `own_endpoint`: answered at one of `waf`'s own endpoints, or `404` for a
       path under `/_sww/`.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a
@@ -124,7 +125,10 @@ Every one of these lines has:
     - `rate_limits`: `window`, `count` and `limit`;
     - `trap_paths`: `path`, the trap path asked for;
     - `rule_files`: `rule_id` and `rule_action`, of the rule that refused it;
-    - `header_limits`: `fields`, `fields_limit`, `cookies` and `cookies_limit`;
+    - `header_limits`: for a request line, `request_line_bytes` and
+      `request_line_bytes_limit`; for headers, `longest_header_line_bytes`,
+      `header_line_bytes_limit`, `fields`, `fields_limit`, `cookies` and
+      `cookies_limit`;
     - `core_rule_set`: `score`, and `threshold`,
       `SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD`;
     - `refusal_limit`: `window`, `count` and `limit`, of the refusal limit;

docs/settings.md

@@ -423,8 +423,9 @@ A few limits are fixed rather than settings:
 - at most 20,000 anomaly counters are kept;
 - each alert destination's queue holds at most 1,000 alerts;
 - `waf` holds at most 10,000 answered requests awaiting their reports;
-- `waf` refuses a request with more than 50 cookies or more than 100 header
-  fields (see "Answering in time" under "`waf`" in [`SPEC.md`](../SPEC.md));
+- `waf` refuses a request with a request line or header line over 8 KiB, more
+  than 50 cookies or more than 100 header fields (see "Answering in time" under
+  "`waf`" in [`SPEC.md`](../SPEC.md));
 - `rproxy` takes a request line and headers of at most 32 KiB, and closes a
   kept-open connection idle for 120 seconds;
 - `rproxy` reads at most 1 MiB of the body of `waf`'s answer, and answers `502`