Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/bans.go

@@ -29,7 +29,11 @@ type activeBan struct{}
 
 func (activeBan) name() string { return "active_ban" }
 
-func (activeBan) check(_ context.Context, rq *request, now time.Time) *verdict {
+func (activeBan) check(
+	_ context.Context,
+	rq *request,
+	now time.Time,
+) *verdict {
 	check := rq.h.ledger.Check
 	if rq.h.config.Observe {
 		check = rq.h.ledger.Find // the ban refuses nothing, and stays as it is
@@ -101,7 +105,11 @@ func (rq *request) countedBytes() int64 {
 // the client's counters back to zero. In observe mode it makes no ban and
 // sets nothing back, and raises the alert for the ban it would have made,
 // if that alert would be sent.
-func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
+func (rq *request) banForLimit(
+	now time.Time,
+	hit ratelimit.Hit,
+	status int,
+) {
 	switch hit.Kind {
 	case ratelimit.KindBytes:
 		rq.line.LimitHit = hit.Window + "_bytes" // as counts names the byte totals
@@ -115,7 +123,8 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 	rq.h.metrics.LimitHit(hit)
 
 	netblock := rq.h.netblock(rq.client)
-	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseLimit) {
+	if rq.h.config.Observe &&
+		!rq.wouldAlertBan(netblock, now, bans.CauseLimit) {
 		return
 	}
 
@@ -164,8 +173,11 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 // alert would be sent. It returns the action for that ban.
 func (rq *request) banForAttack(now time.Time, notes bans.Notes) string {
 	netblock := rq.h.netblock(rq.client)
-	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseAttack) {
-		return banAction(rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseAttack))
+	if rq.h.config.Observe &&
+		!rq.wouldAlertBan(netblock, now, bans.CauseAttack) {
+		return banAction(
+			rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseAttack),
+		)
 	}
 
 	notes.ASN = rq.line.ASN
@@ -198,10 +210,16 @@ func (rq *request) banForAttack(now time.Time, notes bans.Notes) string {
 // CrowdSec's decision on the client, ends. In observe mode it makes no
 // ban, and raises the alert for the ban it would have made, if that alert
 // would be sent. It returns the action for that ban.
-func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) string {
+func (rq *request) banForCrowdSec(
+	now time.Time,
+	decision reputation.Decision,
+) string {
 	netblock := rq.h.netblock(rq.client)
-	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseCrowdSec) {
-		return banAction(rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseCrowdSec))
+	if rq.h.config.Observe &&
+		!rq.wouldAlertBan(netblock, now, bans.CauseCrowdSec) {
+		return banAction(
+			rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseCrowdSec),
+		)
 	}
 
 	notes := bans.Notes{
@@ -214,8 +232,13 @@ func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) s
 	}
 
 	if rq.h.config.Observe {
-		ban, wouldBan := rq.h.ledger.WouldBanForCrowdSec(netblock, now, decision.Expires,
-			decision.Scenario, notes)
+		ban, wouldBan := rq.h.ledger.WouldBanForCrowdSec(
+			netblock,
+			now,
+			decision.Expires,
+			decision.Scenario,
+			notes,
+		)
 		if wouldBan {
 			rq.alertBan(ban)
 		}