Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/discriminator/biased.go

@@ -18,7 +18,7 @@ type percentage struct {
 
 // biasedThresholdsSet reports whether a biased threshold can lower a
 // client's limits: one of its lists is not empty,
-// SWW_UNKNOWN_LIMIT_PERCENT is below 100, or SWW_ASN_LIMIT_PERCENT_URL
+// SWW_WAF_UNKNOWN_LIMIT_PERCENT is below 100, or SWW_WAF_ASN_LIMIT_PERCENT_URL
 // is set. The client's lookup is then needed before its request goes on.
 func biasedThresholdsSet(cfg *config.Config) bool {
 	return len(cfg.ASNLimitPercent) > 0 || len(cfg.CountryLimitPercent) > 0 ||
@@ -31,15 +31,15 @@ func biasedThresholdsSet(cfg *config.Config) bool {
 // up, each "" when unknown, and the blocklists, DNSBL zones and AbuseIPDB
 // that list it. Each is the lowest of those the settings give it, the
 // first of them in the order below when several are lowest: the
-// percentage SWW_ASN_LIMIT_PERCENT gives its AS number, the one the file
-// SWW_ASN_LIMIT_PERCENT_URL names gives it, the one
-// SWW_COUNTRY_LIMIT_PERCENT gives its country, for a client without a
+// percentage SWW_WAF_ASN_LIMIT_PERCENT gives its AS number, the one the file
+// SWW_WAF_ASN_LIMIT_PERCENT_URL names gives it, the one
+// SWW_WAF_COUNTRY_LIMIT_PERCENT gives its country, for a client without a
 // country, unless its request skipped the wait for GeoJS,
-// SWW_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists, the
-// percentage of SWW_BLOCKLIST_ACTION while it is limit, and for a client
+// SWW_WAF_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists, the
+// percentage of SWW_WAF_BLOCKLIST_ACTION while it is limit, and for a client
 // a DNSBL zone's verdict lists, or whose AbuseIPDB score is a hit, the
-// percentage of SWW_REPUTATION_ACTION while it is limit. For the byte
-// limits, SWW_ASN_BYTES_PERCENT and SWW_COUNTRY_BYTES_PERCENT take the
+// percentage of SWW_WAF_REPUTATION_ACTION while it is limit. For the byte
+// limits, SWW_WAF_ASN_BYTES_PERCENT and SWW_WAF_COUNTRY_BYTES_PERCENT take the
 // place of the first three for an AS number or a country they list.
 func (rq *request) limitPercentages() (percentage, percentage) {
 	cfg := rq.h.config
@@ -47,36 +47,37 @@ func (rq *request) limitPercentages() (percentage, percentage) {
 
 	unknown := percentage{percent: whole}
 	if country == "" && !rq.skippedLookupWait {
-		unknown = percentage{cfg.UnknownLimitPercent, "SWW_UNKNOWN_LIMIT_PERCENT"}
+		unknown = percentage{cfg.UnknownLimitPercent, "SWW_WAF_UNKNOWN_LIMIT_PERCENT"}
 	}
 
 	fetched := percentage{percent: whole}
 	if percent, listed := rq.h.lists.ASNLimitPercent(asn); listed {
-		fetched = percentage{percent, "SWW_ASN_LIMIT_PERCENT_URL"}
+		fetched = percentage{percent, "SWW_WAF_ASN_LIMIT_PERCENT_URL"}
 	}
 
 	blocklisted := percentage{percent: whole}
 	if rq.blocklisted && cfg.BlocklistAction == "limit" {
-		blocklisted = percentage{cfg.BlocklistLimitPercent, "SWW_BLOCKLIST_ACTION"}
+		blocklisted = percentage{cfg.BlocklistLimitPercent, "SWW_WAF_BLOCKLIST_ACTION"}
 	}
 
 	reputationListed := percentage{percent: whole}
 	if (rq.dnsblListed || rq.abuseIPDBHit) && cfg.ReputationAction == "limit" {
-		reputationListed = percentage{cfg.ReputationLimitPercent, "SWW_REPUTATION_ACTION"}
+		reputationListed = percentage{cfg.ReputationLimitPercent, "SWW_WAF_REPUTATION_ACTION"}
 	}
 
-	asnRequests := lowest(given(cfg.ASNLimitPercent, asn, "SWW_ASN_LIMIT_PERCENT"),
+	asnRequests := lowest(given(cfg.ASNLimitPercent, asn, "SWW_WAF_ASN_LIMIT_PERCENT"),
 		fetched)
 	countryRequests := given(cfg.CountryLimitPercent, country,
-		"SWW_COUNTRY_LIMIT_PERCENT")
+		"SWW_WAF_COUNTRY_LIMIT_PERCENT")
 
 	asnBytes, countryBytes := asnRequests, countryRequests
 	if _, listed := cfg.ASNBytesPercent[asn]; listed {
-		asnBytes = given(cfg.ASNBytesPercent, asn, "SWW_ASN_BYTES_PERCENT")
+		asnBytes = given(cfg.ASNBytesPercent, asn, "SWW_WAF_ASN_BYTES_PERCENT")
 	}
 
 	if _, listed := cfg.CountryBytesPercent[country]; listed {
-		countryBytes = given(cfg.CountryBytesPercent, country, "SWW_COUNTRY_BYTES_PERCENT")
+		countryBytes = given(cfg.CountryBytesPercent, country,
+			"SWW_WAF_COUNTRY_BYTES_PERCENT")
 	}
 
 	return lowest(asnRequests, countryRequests, unknown, blocklisted, reputationListed),