servewaf always answers rproxy well within its time limit (closes #182)

A question waits on GeoJS at most 800ms, the new default of
SWWAF_LOOKUP_TIMEOUT. In enforce mode it does not wait at all when it is
over the header limits, on a fetched blocklist with deny, on the CrowdSec
decision list, or over a whole rate limit. Not waiting never lowers a
client's limit. Just before the Core Rule Set, servewaf refuses more than
50 cookies or 100 header fields with 431.

Shared default changed: SWWAF_LOOKUP_TIMEOUT also applies to smallwebwaf
with no command.
Judgement call: SWWAF_REPUTATION_TIMEOUT stays 2s, since no request waits
on the DNS blocklists or AbuseIPDB.

Model: opus-5-5

internal/proxy/metrics_test.go

@@ -424,8 +424,8 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 	req.Header.Set(forwardedFor, fromDE)
 	wantStatus(t, do(t, req), http.StatusOK)
 
-	// The client stops waiting for GeoJS after a second, so GeoJS's
-	// failure can come after its request has ended.
+	// The client stops waiting for GeoJS once SWWAF_LOOKUP_TIMEOUT is up, so
+	// GeoJS's failure can come after its request has ended.
 	deadline := time.Now().Add(waitLimit)
 	metrics := scrape(t, addr)