Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/discriminator/request.go

@@ -44,7 +44,7 @@ type decision struct {
 	lookedUp     bool
 	lookupAnswer lookup.Answer
 	// skippedLookupWait is true for a request that did not wait for GeoJS and
-	// found no answer kept. SWW_UNKNOWN_LIMIT_PERCENT does not apply to it,
+	// found no answer kept. SWW_WAF_UNKNOWN_LIMIT_PERCENT does not apply to it,
 	// so that not waiting never lowers its client's limits.
 	skippedLookupWait bool
 	// counted is true for a request the rate limits counted, whose bytes
@@ -161,7 +161,7 @@ func requestHeaders(r *http.Request, names []string) map[string]string {
 
 // check is the one place where a request can be refused. It returns nil to let
 // the request through. The checks of checkClient decide: a request they refuse
-// is answered with SWW_BAN_RESPONSE, 403 for a block rule or the Core Rule Set,
+// is answered with SWW_WAF_BAN_RESPONSE, 403 for a block rule or the Core Rule Set,
 // or 431 for the header limits. In observe mode nothing is refused, and the log
 // line names what enforce mode would have done. ctx is the request's own context.
 func (rq *request) check(ctx context.Context) *refusal {
@@ -185,17 +185,17 @@ func (rq *request) check(ctx context.Context) *refusal {
 
 // checkClient runs the checks on the request's client, and returns the
 // action of the first that refuses the request, or "" when none does. A
-// client in SWW_ALLOW_NETS skips them, and is not looked up. For any
-// other client, SWW_DENY_NETS comes first, then a ban on its netblock,
+// client in SWW_WAF_ALLOW_NETS skips them, and is not looked up. For any
+// other client, SWW_WAF_DENY_NETS comes first, then a ban on its netblock,
 // so that a client either refuses is not looked up, then the lookup of
 // its AS number and country, then the country lists, then the blocklists,
 // then the CrowdSec decision list, which bans the client it lists, then
 // the DNSBL zones' verdicts, and then AbuseIPDB's score; a request any of
 // them refuses is not counted for the rate limits. Then come the
-// rate limits, unless the client is in SWW_RATE_LIMIT_EXEMPT_NETS or the
-// request's path is exempt under SWW_RATE_LIMIT_EXEMPT_PATHS, so that
+// rate limits, unless the client is in SWW_WAF_RATE_LIMIT_EXEMPT_NETS or the
+// request's path is exempt under SWW_WAF_RATE_LIMIT_EXEMPT_PATHS, so that
 // every other request is counted, each of them by the client's limit
-// percentages, then SWW_TRAP_PATHS, then the rule files, then the header
+// percentages, then SWW_WAF_TRAP_PATHS, then the rule files, then the header
 // limits, and last the Core Rule Set. A request exempt from the rate limits
 // is exempt from the byte limits too. ctx is the request's own context.
 func (rq *request) checkClient(ctx context.Context) string {
@@ -266,8 +266,8 @@ func (rq *request) checkClient(ctx context.Context) string {
 }
 
 // countedByRateLimits reports whether the rate limits count the request: its
-// client is not in SWW_RATE_LIMIT_EXEMPT_NETS, and its path is not exempt
-// under SWW_RATE_LIMIT_EXEMPT_PATHS.
+// client is not in SWW_WAF_RATE_LIMIT_EXEMPT_NETS, and its path is not exempt
+// under SWW_WAF_RATE_LIMIT_EXEMPT_PATHS.
 func (rq *request) countedByRateLimits() bool {
 	cfg := rq.h.config
 
@@ -276,7 +276,7 @@ func (rq *request) countedByRateLimits() bool {
 }
 
 // pathExempt reports whether r is exempt under prefixes,
-// SWW_RATE_LIMIT_EXEMPT_PATHS or SWW_WAF_EXEMPT_PATHS: whether its
+// SWW_WAF_RATE_LIMIT_EXEMPT_PATHS or SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS: whether its
 // path as sent, the path the app receives, not percent-decoded, starts
 // with one of prefixes, so that /%61ssets/x is not under /assets/ for an
 // app whose router matches the path as received. A request whose decoded
@@ -378,9 +378,9 @@ func (rq *request) addToHistory() {
 
 // countAnomalies counts the request, which has ended, and its bytes, as
 // countedBytes gives them, for the anomaly thresholds, whatever was done
-// with it: a request refused, one from a client in SWW_ALLOW_NETS or
-// SWW_RATE_LIMIT_EXEMPT_NETS, and one for a path in
-// SWW_RATE_LIMIT_EXEMPT_PATHS are counted too. It is counted for its
+// with it: a request refused, one from a client in SWW_WAF_ALLOW_NETS or
+// SWW_WAF_RATE_LIMIT_EXEMPT_NETS, and one for a path in
+// SWW_WAF_RATE_LIMIT_EXEMPT_PATHS are counted too. It is counted for its
 // client's AS number when answerAtTheEnd gives one. With every anomaly
 // threshold off, the default, it does nothing.
 func (rq *request) countAnomalies() {