Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/reputation/abuseipdb.go

@@ -260,7 +260,11 @@ func (a *AbuseIPDB) LoadChecksSpent(checks ChecksSpent) {
 // the score as client's, and notes the check as no longer under way. A
 // check that fails gives no score: it is counted, logged and raised as a
 // source_failure alert, and no client is checked for failureDelay.
-func (a *AbuseIPDB) check(ctx context.Context, client netip.Prefix, addr netip.Addr) {
+func (a *AbuseIPDB) check(
+	ctx context.Context,
+	client netip.Prefix,
+	addr netip.Addr,
+) {
 	score, err := a.ask(ctx, addr)
 	now := a.params.Now()
 
@@ -269,7 +273,10 @@ func (a *AbuseIPDB) check(ctx context.Context, client netip.Prefix, addr netip.A
 	delete(a.checking, client)
 
 	if err == nil {
-		a.scores.Add(client, Score{Client: client, Score: score, Fetched: now})
+		a.scores.Add(
+			client,
+			Score{Client: client, Score: score, Fetched: now},
+		)
 	} else {
 		a.failures++
 		a.retryAt = now.Add(failureDelay)
@@ -285,7 +292,10 @@ func (a *AbuseIPDB) check(ctx context.Context, client netip.Prefix, addr netip.A
 // ask asks AbuseIPDB for addr's abuse confidence score, sending the key
 // in the header Key. An answer other than 200, one that gives no score,
 // and none within Timeout, fail.
-func (a *AbuseIPDB) ask(ctx context.Context, addr netip.Addr) (int64, error) {
+func (a *AbuseIPDB) ask(
+	ctx context.Context,
+	addr netip.Addr,
+) (int64, error) {
 	ctx, cancel := context.WithTimeout(ctx, a.params.Timeout)
 	defer cancel()
 
@@ -321,7 +331,8 @@ func (a *AbuseIPDB) ask(ctx context.Context, addr netip.Addr) (int64, error) {
 		} `json:"data"`
 	}
 
-	err = json.NewDecoder(io.LimitReader(res.Body, maxAnswerBytes)).Decode(&answer)
+	err = json.NewDecoder(io.LimitReader(res.Body, maxAnswerBytes)).
+		Decode(&answer)
 	if err != nil {
 		return 0, fmt.Errorf("read the answer: %w", err)
 	}
@@ -339,5 +350,11 @@ func (a *AbuseIPDB) alert(reason string, err error) {
 	// Raised before it is logged, so that the alert is there once the log
 	// line is.
 	raiseFailure(a.params.Alerts, reason, AbuseIPDBSource, err)
-	a.params.ProcessLog.Warn(reason, "source", AbuseIPDBSource, "error", err.Error())
+	a.params.ProcessLog.Warn(
+		reason,
+		"source",
+		AbuseIPDBSource,
+		"error",
+		err.Error(),
+	)
 }