Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/ratelimits_test.go

@@ -42,7 +42,11 @@ func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
 		{otherClient, otherClient, http.StatusOK},
 		{"::ffff:" + otherClient, otherClient, http.StatusForbidden},
 		{"2001:db8::1", "2001:db8::1", http.StatusOK},
-		{"2001:db8::8000:0:0:1", "2001:db8::8000:0:0:1", http.StatusForbidden},
+		{
+			"2001:db8::8000:0:0:1",
+			"2001:db8::8000:0:0:1",
+			http.StatusForbidden,
+		},
 		{"2001:db8:0:1::1", "2001:db8:0:1::1", http.StatusOK},
 	}
 
@@ -53,7 +57,11 @@ func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
 
 		line := out.endedLines(t, i+1)[i]
 		if line.ClientIP != sent.logged {
-			t.Errorf("log line has client_ip %q, want %q", line.ClientIP, sent.logged)
+			t.Errorf(
+				"log line has client_ip %q, want %q",
+				line.ClientIP,
+				sent.logged,
+			)
 		}
 
 		if sent.want == http.StatusOK {
@@ -75,12 +83,25 @@ func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
 func TestRateLimitRefusalNamesItsHeuristicWindowCountAndLimit(t *testing.T) {
 	t.Parallel()
 
-	s, _, _ := startWithClock(t, "", map[string]string{rateLimitPerMinute: "1"})
+	s, _, _ := startWithClock(
+		t,
+		"",
+		map[string]string{rateLimitPerMinute: "1"},
+	)
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-	wantHeuristic(t, line, "rate_limits", `{"window": "minute", "count": 2, "limit": 1}`)
+	line := s.get(
+		client,
+		http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited,
+	)
+	wantHeuristic(
+		t,
+		line,
+		"rate_limits",
+		`{"window": "minute", "count": 2, "limit": 1}`,
+	)
 }
 
 func TestIPv6GroupPrefixSetsTheClientTheLimitsCount(t *testing.T) {
@@ -148,11 +169,26 @@ func TestRateLimitExemptPathsAreNeitherCountedNorRefused(t *testing.T) {
 	// With a limit of one request a minute, the requests for paths under a
 	// prefix are not counted, so client's first request for / is within
 	// the limit; and once client has reached it, they are not refused.
-	s.request(client, "/assets/app.js", http.StatusOK, requestlog.ActionForward)
-	s.request(client, "/favicon.ico?v=2", http.StatusOK, requestlog.ActionForward)
+	s.request(
+		client,
+		"/assets/app.js",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
+	s.request(
+		client,
+		"/favicon.ico?v=2",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	line := s.request(client, "/assets/app.js", http.StatusOK, requestlog.ActionForward)
+	line := s.request(
+		client,
+		"/assets/app.js",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	if line.LimitHit != "" || line.Counts != (ratelimit.Counts{}) {
 		t.Errorf("log line has limit_hit %q and counts %+v, want neither",
 			line.LimitHit, line.Counts)
@@ -214,7 +250,12 @@ func TestRateLimitCountsPathsThatAreNotExempt(t *testing.T) {
 			// Counted, the second request breaks the limit of one request
 			// a minute.
 			s.request(client, sent, http.StatusOK, requestlog.ActionForward)
-			s.request(client, sent, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+			s.request(
+				client,
+				sent,
+				http.StatusForbidden,
+				requestlog.ActionClientIsRateLimited,
+			)
 		})
 	}
 }