Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/requestlog/requestlog.go

@@ -33,12 +33,12 @@ const (
 	// rule.
 	ActionRuleBlocked = "rule_blocked"
 	// ActionWAFBlocked is a request refused because the Core Rule Set
-	// scored it at or over SWW_WAF_ANOMALY_THRESHOLD.
+	// scored it at or over SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD.
 	ActionWAFBlocked = "waf_blocked"
 	// ActionDenied is a request refused because its client is in
-	// SWW_DENY_NETS, in a blocklist while SWW_BLOCKLIST_ACTION is deny,
+	// SWW_WAF_DENY_NETS, in a blocklist while SWW_WAF_BLOCKLIST_ACTION is deny,
 	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
-	// SWW_REPUTATION_ACTION is deny.
+	// SWW_WAF_REPUTATION_ACTION is deny.
 	ActionDenied = "denied"
 	// ActionCountryDenied is a request refused for its client's country.
 	ActionCountryDenied = "country_denied"
@@ -112,7 +112,7 @@ type Line struct {
 	ContentType  string `json:"content_type,omitempty"`
 	// ContentLength is the length of its body the request announced.
 	ContentLength int64 `json:"content_length,omitempty"`
-	// RequestHeaders are the headers SWW_LOG_REQUEST_HEADERS names that
+	// RequestHeaders are the headers SWW_WAF_LOG_REQUEST_HEADERS names that
 	// the request carried, by name in lower case.
 	RequestHeaders   map[string]string `json:"request_headers,omitempty"`
 	HasAuthorization bool              `json:"has_authorization,omitempty"`
@@ -202,7 +202,7 @@ type RProxyLine struct {
 	DurationRequest  float64 `json:"duration_request"`
 	DurationResponse float64 `json:"duration_response"`
 	// Disposition is the valid disposition discriminator answered or, while
-	// DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is ""
+	// DefaultDisposition is true, the value of SWW_RPROXY_DEFAULT_DISPOSITION. It is ""
 	// when neither gave one.
 	Disposition        string `json:"disposition,omitempty"`
 	DefaultDisposition bool   `json:"default_disposition,omitempty"`
@@ -250,8 +250,8 @@ func Milliseconds(d time.Duration) float64 {
 
 // NewProcessLogger returns the logger for the process's own messages:
 // JSON lines on w, marked "type":"process", with the time in the same form
-// as a request line's, and instanceName, SWW_INSTANCE_NAME, as instance.
-// It writes only the messages at level, SWW_LOG_LEVEL, or more severe;
+// as a request line's, and instanceName, SWW_WAF_INSTANCE_NAME, as instance.
+// It writes only the messages at level, SWW_WAF_LOG_LEVEL, or more severe;
 // the request lines Write writes are never held back.
 func NewProcessLogger(w io.Writer, instanceName string, level slog.Level) *slog.Logger {
 	handler := slog.NewJSONHandler(w, &slog.HandlerOptions{