Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/waf/anomaly_test.go

@@ -21,11 +21,11 @@ import (
 // The anomaly thresholds: the prefix of a scope followed by the end of a
 // count.
 const (
-	anomalyClient = "SWW_ANOMALY_CLIENT_"
-	anomalyNet    = "SWW_ANOMALY_NET_"
-	anomalyASN    = "SWW_ANOMALY_ASN_"
-	anomalyTotal  = "SWW_ANOMALY_TOTAL_"
-	anomalyWatch  = "SWW_WATCH_"
+	anomalyClient = "SWW_WAF_ANOMALY_CLIENT_"
+	anomalyNet    = "SWW_WAF_ANOMALY_NET_"
+	anomalyASN    = "SWW_WAF_ANOMALY_ASN_"
+	anomalyTotal  = "SWW_WAF_ANOMALY_TOTAL_"
+	anomalyWatch  = "SWW_WAF_WATCH_"
 
 	requestsPerMinute = "REQUESTS_PER_MINUTE"
 	requestsPerHour   = "REQUESTS_PER_HOUR"
@@ -35,9 +35,9 @@ const (
 
 // The other anomaly settings.
 const (
-	anomalyNetV4Prefix = "SWW_ANOMALY_NET_V4_PREFIX"
-	anomalyNetV6Prefix = "SWW_ANOMALY_NET_V6_PREFIX"
-	watchNets          = "SWW_WATCH_NETS"
+	anomalyNetV4Prefix = "SWW_WAF_ANOMALY_NET_V4_PREFIX"
+	anomalyNetV6Prefix = "SWW_WAF_ANOMALY_NET_V6_PREFIX"
+	watchNets          = "SWW_WAF_WATCH_NETS"
 )
 
 const (
@@ -168,9 +168,9 @@ func TestEveryRequestIsCountedWhateverIsDoneWithIt(t *testing.T) {
 	t.Parallel()
 
 	const (
-		allowed = "192.0.2.7"  // in SWW_ALLOW_NETS
-		exempt  = "192.0.2.10" // in SWW_RATE_LIMIT_EXEMPT_NETS
-		denied  = "192.0.2.20" // in SWW_DENY_NETS
+		allowed = "192.0.2.7"  // in SWW_WAF_ALLOW_NETS
+		exempt  = "192.0.2.10" // in SWW_WAF_RATE_LIMIT_EXEMPT_NETS
+		denied  = "192.0.2.20" // in SWW_WAF_DENY_NETS
 	)
 
 	s, _, _, queue := startAppWithAlerts(t, readAndAnswer, map[string]string{