Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/coreruleset/coreruleset.go

@@ -292,9 +292,11 @@ var errSwwRuleID = errors.New("an id of sww's own rules")
 // directive that removes or changes rules as it loads, such as
 // SecRuleRemoveById. The Core Rule Set's rules load after the file, so
 // the directive finds none of them.
-var errChangesNoRule = errors.New("the Core Rule Set's rules load after the file; " +
-	"switch a rule off with SWW_WAF_DISABLED_RULES, or on some requests " +
-	"with a ctl exclusion")
+var errChangesNoRule = errors.New(
+	"the Core Rule Set's rules load after the file; " +
+		"switch a rule off with SWW_WAF_DISABLED_RULES, or on some requests " +
+		"with a ctl exclusion",
+)
 
 // directivesIn returns the directives in text as Coraza reads them: it
 // skips blank lines and comment lines, and joins a line ending in \ to
@@ -338,18 +340,27 @@ func checkExclusions(exclusions string) error {
 			}
 
 			if first <= lastOwnRuleID && last >= firstOwnRuleID {
-				return fmt.Errorf("the exclusions file names %s: %w", match[0],
-					errSwwRuleID)
+				return fmt.Errorf(
+					"the exclusions file names %s: %w",
+					match[0],
+					errSwwRuleID,
+				)
 			}
 		}
 
 		// Coraza takes the directive's name up to the first space, without
 		// regard to case.
 		name, _, _ := strings.Cut(directive, " ")
-		if lower := strings.ToLower(name); strings.HasPrefix(lower, "secruleremove") ||
+		if lower := strings.ToLower(name); strings.HasPrefix(
+			lower,
+			"secruleremove",
+		) ||
 			strings.HasPrefix(lower, "secruleupdate") {
-			return fmt.Errorf("%s in the exclusions file changes no rule: %w", name,
-				errChangesNoRule)
+			return fmt.Errorf(
+				"%s in the exclusions file changes no rule: %w",
+				name,
+				errChangesNoRule,
+			)
 		}
 	}
 
@@ -488,7 +499,10 @@ func (c *CoreRuleSet) Inspect(
 // readBody reads one byte past the limit, to tell which they are, gives
 // the Core Rule Set what it reads, and returns what it read and the error
 // that ended the reading early, if one did.
-func (c *CoreRuleSet) readBody(tx types.Transaction, body io.Reader) ([]byte, error) {
+func (c *CoreRuleSet) readBody(
+	tx types.Transaction,
+	body io.Reader,
+) ([]byte, error) {
 	if c.bodyLimit == 0 {
 		return nil, nil
 	}