Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/discriminator/metrics_test.go

@@ -17,9 +17,9 @@ import (
 )
 
 const (
-	metricsToken = "SWW_METRICS_TOKEN" //nolint:gosec // the setting's name
-	metricsTopN  = "SWW_METRICS_TOP_N"
-	// token is the SWW_METRICS_TOKEN the tests set, and bearer how a
+	metricsToken = "SWW_WAF_METRICS_TOKEN" //nolint:gosec // the setting's name
+	metricsTopN  = "SWW_WAF_METRICS_TOP_N"
+	// token is the SWW_WAF_METRICS_TOKEN the tests set, and bearer how a
 	// request carries it.
 	token  = "0123456789abcdef0123456789abcdef"
 	bearer = "Bearer " + token
@@ -113,7 +113,7 @@ func TestMetricsCountTheTraffic(t *testing.T) {
 func TestMetricsCountLimitsAndBans(t *testing.T) {
 	t.Parallel()
 
-	const denied = "192.0.2.50" // in SWW_DENY_NETS
+	const denied = "192.0.2.50" // in SWW_WAF_DENY_NETS
 
 	s, clk, _ := startWithClock(t, "", map[string]string{
 		metricsToken:       token,
@@ -124,7 +124,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 		maxBanDuration:     "2h",
 	})
 
-	// SWW_BAN_RESPONSE=close sends no status at all.
+	// SWW_WAF_BAN_RESPONSE=close sends no status at all.
 	s.get(denied, 0, requestlog.ActionDenied)
 
 	// A first broken limit bans for an hour.
@@ -145,7 +145,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	wantMetric(t, s.scrape(), `sww_active_bans{instance="app"}`, 0)
 
 	// A limit broken again right after would ban for three hours, longer
-	// than SWW_MAX_BAN_DURATION, so the ban is permanent.
+	// than SWW_WAF_MAX_BAN_DURATION, so the ban is permanent.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, 0, requestlog.ActionRateLimited)
 
@@ -328,12 +328,12 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 		})
 
 	// GeoJS fails, so the client counts as coming from an unknown country,
-	// which SWW_DENIED_COUNTRIES does not refuse.
+	// which SWW_WAF_DENIED_COUNTRIES does not refuse.
 	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 	req.Header.Set(forwardedFor, fromDE)
 	wantStatus(t, do(t, req), http.StatusOK)
 
-	// The client stops waiting for GeoJS once SWW_LOOKUP_TIMEOUT is up, so
+	// The client stops waiting for GeoJS once SWW_WAF_LOOKUP_TIMEOUT is up, so
 	// GeoJS's failure can come after its request has ended.
 	deadline := time.Now().Add(waitLimit)
 	metrics := scrape(t, server.Addr)