Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/anomaly_test.go

@@ -51,7 +51,9 @@ const (
 	hour = "hour"
 )
 
-func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(t *testing.T) {
+func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, scope := range []struct {
@@ -95,9 +97,8 @@ func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(t *testing.T) {
 			t.Run(setting, func(t *testing.T) {
 				t.Parallel()
 
-				s, clk, server, queue := startWithLookupsAndClock(t, map[string]string{
-					setting: value, watchNets: office,
-				})
+				env := map[string]string{setting: value, watchNets: office}
+				s, clk, server, queue := startWithLookupsAndClock(t, env)
 				start := clk.Now()
 
 				// The third upload takes the count over the threshold, and the
@@ -156,7 +157,10 @@ func wantAlertedAgainOnceTheCooldownHasRunOut(
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
 	if len(waiting) != 2 || !waiting[1].Time.Equal(clk.Now()) ||
 		waiting[1].SuppressedRepeats != 1 {
-		t.Errorf("alerts wait %+v, want the first and another, with 1 repeat", waiting)
+		t.Errorf(
+			"alerts wait %+v, want the first and another, with 1 repeat",
+			waiting,
+		)
 	}
 }
 
@@ -201,7 +205,10 @@ func TestEveryRequestIsCountedWhateverIsDoneWithIt(t *testing.T) {
 		got = append(got, alert.Client.String())
 	}
 
-	if want := []string{allowed, exempt, client, denied}; !slices.Equal(got, want) {
+	if want := []string{allowed, exempt, client, denied}; !slices.Equal(
+		got,
+		want,
+	) {
 		t.Errorf("alerts for the clients %v, want %v", got, want)
 	}
 }
@@ -210,7 +217,10 @@ func TestThresholdsOffCountNothingAndAlertNothing(t *testing.T) {
 	t.Parallel()
 
 	// With every threshold off, nothing is counted.
-	s, server, queue := startWithLookups(t, map[string]string{watchNets: office})
+	s, server, queue := startWithLookups(
+		t,
+		map[string]string{watchNets: office},
+	)
 
 	for range 5 {
 		s.uploadFrom(client)
@@ -306,7 +316,10 @@ func TestClientIsCountedForItsASNumberOnceTheLookupGivesOne(t *testing.T) {
 		got[counter.ASN] = counter.Minute.Current
 	}
 
-	if want := map[string]int64{asnDE: 2, asnKP: 1, "AS64500": 1}; !maps.Equal(got, want) {
+	if want := map[string]int64{asnDE: 2, asnKP: 1, "AS64500": 1}; !maps.Equal(
+		got,
+		want,
+	) {
 		t.Errorf("requests by AS number %v, want %v", got, want)
 	}
 }
@@ -324,7 +337,9 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		release()
 		waitUntil(func() bool {
-			_, kept := server.Load().GeoJS.Kept(netip.MustParsePrefix(fromDE + "/32"))
+			_, kept := server.Load().GeoJS.Kept(
+				netip.MustParsePrefix(fromDE + "/32"),
+			)
 
 			return kept
 		})
@@ -342,7 +357,10 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 	// number it gives.
 	s := &sender{t: t, addr: addr, out: out}
 	if line := s.get(fromDE, http.StatusOK, requestlog.ActionForward); line.ASN != "" {
-		t.Errorf("log line has AS number %q, want none: the request waited", line.ASN)
+		t.Errorf(
+			"log line has AS number %q, want none: the request waited",
+			line.ASN,
+		)
 	}
 
 	want := []anomaly.Counter{{
@@ -357,10 +375,15 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 func TestEachNamedNetblockCountsTheClientsInIt(t *testing.T) {
 	t.Parallel()
 
-	s, _, server, _ := startAppWithAlerts(t, readAndAnswer, map[string]string{
-		anomalyWatch + requestsPerMinute: aLot,
-		watchNets:                        office + ",wide=203.0.0.0/16,other=198.51.100.0/25",
-	})
+	s, _, server, _ := startAppWithAlerts(
+		t,
+		readAndAnswer,
+		map[string]string{
+			anomalyWatch + requestsPerMinute: aLot,
+			watchNets: office + ",wide=203.0.0.0/16" +
+				",other=198.51.100.0/25",
+		},
+	)
 
 	// client is in office and in wide.
 	for _, from := range []string{client, "203.0.200.1", "192.0.2.7"} {
@@ -372,7 +395,10 @@ func TestEachNamedNetblockCountsTheClientsInIt(t *testing.T) {
 		got[counter.Name] = counter.Minute.Current
 	}
 
-	if want := map[string]int64{"office": 1, "wide": 2}; !maps.Equal(got, want) {
+	if want := map[string]int64{"office": 1, "wide": 2}; !maps.Equal(
+		got,
+		want,
+	) {
 		t.Errorf("requests by named netblock %v, want %v", got, want)
 	}
 }