Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/discriminator/coreruleset_test.go

@@ -14,13 +14,13 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// The Core Rule Set's settings the tests set, besides SWW_WAF_MODE, and
+// The Core Rule Set's settings the tests set, besides SWW_WAF_CORE_RULE_SET_MODE, and
 // its two modes that inspect requests.
 const (
-	wafAnomalyThreshold = "SWW_WAF_ANOMALY_THRESHOLD"
-	wafDisabledRules    = "SWW_WAF_DISABLED_RULES"
-	wafExemptPaths      = "SWW_WAF_EXEMPT_PATHS"
-	wafBodyLimit        = "SWW_WAF_BODY_LIMIT"
+	wafAnomalyThreshold = "SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD"
+	wafDisabledRules    = "SWW_WAF_CORE_RULE_SET_DISABLED_RULES"
+	wafExemptPaths      = "SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS"
+	wafBodyLimit        = "SWW_WAF_CORE_RULE_SET_BODY_LIMIT"
 	block               = "block"
 	detect              = "detect"
 )
@@ -28,7 +28,7 @@ const (
 // formData is the type of a form's body.
 const formData = "application/x-www-form-urlencoded"
 
-// sizeLimit is SWW_WAF_BODY_LIMIT in the tests that read bodies, 1K as a
+// sizeLimit is SWW_WAF_CORE_RULE_SET_BODY_LIMIT in the tests that read bodies, 1K as a
 // setting.
 const (
 	sizeLimit        = 1 << 10
@@ -37,7 +37,7 @@ const (
 
 // sqlInjection asks for / with an SQL injection in its query, which only
 // the Core Rule Set's rule 942100 matches, with a score of 5, the default
-// SWW_WAF_ANOMALY_THRESHOLD.
+// SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD.
 const sqlInjection = "/?id=1'%20OR%20'1'='1"
 
 // wantWAF checks the request log line's waf_rule_ids and waf_score, and
@@ -125,7 +125,7 @@ func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 ) {
 	t.Parallel()
 
-	const allowed = "192.0.2.60" // in SWW_ALLOW_NETS
+	const allowed = "192.0.2.60" // in SWW_WAF_ALLOW_NETS
 
 	s, _, _ := startWithClock(t, "", map[string]string{
 		wafMode:        block,
@@ -134,7 +134,7 @@ func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 		rulesDir:       writeRules(t, testRules),
 	})
 
-	// A client in SWW_ALLOW_NETS, and a path SWW_WAF_EXEMPT_PATHS
+	// A client in SWW_WAF_ALLOW_NETS, and a path SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS
 	// exempts, are not inspected.
 	line := s.request(allowed, sqlInjection, http.StatusOK, requestlog.ActionForward)
 	wantWAF(t, line, nil)
@@ -153,7 +153,7 @@ func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 		requestlog.ActionRuleBlocked)
 	wantWAF(t, line, nil)
 
-	// With SWW_WAF_MODE off, no request is.
+	// With SWW_WAF_CORE_RULE_SET_MODE off, no request is.
 	s, _, _ = startWithClock(t, "", map[string]string{wafMode: off})
 	line = s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
 	wantWAF(t, line, nil)
@@ -468,8 +468,9 @@ func TestCoreRuleSetMatchRaisesTheWAFBlockAlert(t *testing.T) {
 				Host:     appHost,
 				Client:   netip.MustParseAddr(client),
 				Netblock: netip.MustParsePrefix(client + "/32"),
-				Reason:   "scored by the Core Rule Set at or over SWW_WAF_ANOMALY_THRESHOLD",
-				Detail:   detail,
+				Reason: "scored by the Core Rule Set at or over " +
+					"SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD",
+				Detail: detail,
 			})
 
 			if queue.Suppressed() != 1 {