Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/observe_test.go

@@ -67,7 +67,12 @@ func TestBanActionSaysWhetherTheBanRunsOut(t *testing.T) {
 				server.Ledger.Load([]bans.Ban{ban})
 
 				if modeValue == observe {
-					line := s.request(client, tc.path, http.StatusOK, requestlog.ActionForward)
+					line := s.request(
+						client,
+						tc.path,
+						http.StatusOK,
+						requestlog.ActionForward,
+					)
 					wantWouldAction(t, line, tc.want)
 
 					return
@@ -93,12 +98,21 @@ func TestObserveModeNamesAPermanentBanWhoseAlertWouldBeSent(t *testing.T) {
 		Cause:    bans.CauseAttack,
 	}})
 
-	line := s.request(client, "/wp-login.php", http.StatusOK, requestlog.ActionForward)
+	line := s.request(
+		client,
+		"/wp-login.php",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	wantWouldAction(t, line, requestlog.ActionPermanentlyBanned)
 
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
 	if len(waiting) != 1 || waiting[0].Event != alerts.EventPermanentBan {
-		t.Errorf("alerts waiting are %+v, want one %s", waiting, alerts.EventPermanentBan)
+		t.Errorf(
+			"alerts waiting are %+v, want one %s",
+			waiting,
+			alerts.EventPermanentBan,
+		)
 	}
 }
 
@@ -163,14 +177,22 @@ func TestObserveModeForwardsWhatEnforceModeRefuses(t *testing.T) {
 				{fromDE, requestlog.ActionClientIsRateLimited},
 			} {
 				if !tc.observe {
-					line := s.get(sent.from, http.StatusForbidden, sent.refusal)
+					line := s.get(
+						sent.from,
+						http.StatusForbidden,
+						sent.refusal,
+					)
 					wantWouldAction(t, line, "")
 
 					continue
 				}
 
 				// Passed to the app, which answered it.
-				line := s.get(sent.from, http.StatusOK, requestlog.ActionForward)
+				line := s.get(
+					sent.from,
+					http.StatusOK,
+					requestlog.ActionForward,
+				)
 				wantWouldAction(t, line, sent.refusal)
 			}
 		})
@@ -200,11 +222,16 @@ func TestObserveModeMakesNoBanAndKeepsTheBansItHas(t *testing.T) {
 		line := s.get(client, http.StatusOK, requestlog.ActionForward)
 		wantWouldAction(t, line, requestlog.ActionClientIsRateLimited)
 
-		if line.LimitHit != minute || line.Offence != requestlog.OffenceLimit ||
+		if line.LimitHit != minute ||
+			line.Offence != requestlog.OffenceLimit ||
 			line.BanExpires != "" {
-			t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
-				"want minute, limit and none", line.LimitHit, line.Offence,
-				line.BanExpires)
+			t.Errorf(
+				"log line has limit_hit %q, offence %q and ban_expires %q, "+
+					"want minute, limit and none",
+				line.LimitHit,
+				line.Offence,
+				line.BanExpires,
+			)
 		}
 	}