Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/refusallimit.go

@@ -22,7 +22,11 @@ type refusalLimit struct{}
 
 func (refusalLimit) name() string { return "refusal_limit" }
 
-func (refusalLimit) check(_ context.Context, rq *request, now time.Time) *verdict {
+func (refusalLimit) check(
+	_ context.Context,
+	rq *request,
+	now time.Time,
+) *verdict {
 	cfg := rq.h.config
 	if cfg.ErrorBurstThreshold == 0 {
 		return nil
@@ -42,9 +46,11 @@ func (refusalLimit) check(_ context.Context, rq *request, now time.Time) *verdic
 	status := rq.out.status
 
 	switch rq.line.WouldAction {
-	case requestlog.ActionBlockedByBlockRule, requestlog.ActionBlockedByCoreRuleSet:
+	case requestlog.ActionBlockedByBlockRule,
+		requestlog.ActionBlockedByCoreRuleSet:
 		status = http.StatusForbidden
-	case requestlog.ActionTemporarilyBanned, requestlog.ActionPermanentlyBanned:
+	case requestlog.ActionTemporarilyBanned,
+		requestlog.ActionPermanentlyBanned:
 		status = cfg.BanResponse
 	}