A path holding a character Go escapes reaches the app as the client sent it (closes #126)

ReverseProxy sends the path URL.EscapedPath gives, which decodes and
escapes again a path holding a character such as |, turning %2F into /.
The path as sent now goes in URL.Opaque, which Go sends as it is; the
rate limit and WAF exempt paths and the log line's path use the same
path. A path starting with // is left as before: Go would send it in
Opaque as a scheme and host.

Model: opus-5-5

README.md

@@ -96,11 +96,14 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
 ## What it does so far
 
 - Passes each request to the app and the app's answer back unchanged: method,
-  path, query, headers, body and status. Bodies stream through in both
-  directions and are never held whole in memory, but for the part of a request
-  body the Core Rule Set reads, at most `SWWAF_WAF_BODY_LIMIT` and one byte
-  more, which is held until the app is sent it. A WebSocket, or any other
-  upgraded connection, passes through, and the timeouts do not cut it.
+  path, query, headers, body and status. The one exception is a path starting
+  with `//` that holds a character Go escapes, such as `|`: Go cannot send it as
+  it is, and the app receives it decoded and escaped again, `%2F` as `/`. Bodies
+  stream through in both directions and are never held whole in memory, but for
+  the part of a request body the Core Rule Set reads, at most
+  `SWWAF_WAF_BODY_LIMIT` and one byte more, which is held until the app is sent
+  it. A WebSocket, or any other upgraded connection, passes through, and the
+  timeouts do not cut it.
 - Works out the client's address. A TCP peer outside `SWWAF_TRUSTED_PROXIES` is
   the client, and the forwarded headers it sends are replaced, not passed on.
   For a peer inside it, `X-Forwarded-For` is read from the right, and the first