Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/staticlists_test.go

@@ -68,7 +68,11 @@ func TestRequestFromAllowNetsIsNotCounted(t *testing.T) {
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
+		{
+			unlistedAddr,
+			http.StatusForbidden,
+			requestlog.ActionClientIsRateLimited,
+		},
 	})
 }
 
@@ -87,7 +91,13 @@ func TestDenyNetsRefuseBeforeTheLookup(t *testing.T) {
 		tagDeny:        denyKP,
 	})
 
-	req := newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body"))
+	req := newRequest(
+		t,
+		http.MethodPost,
+		addr,
+		"/",
+		strings.NewReader("a body"),
+	)
 	req.Header.Set(forwardedFor, fromDE)
 	wantStatus(t, do(t, req), http.StatusForbidden)
 
@@ -108,7 +118,11 @@ func TestDenyNetsRefusalNamesItsHeuristicAndNetblock(t *testing.T) {
 
 	s, _, _ := startWithClock(t, "", map[string]string{denyNets: clientsNet})
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionClientDenied)
+	line := s.get(
+		client,
+		http.StatusForbidden,
+		requestlog.ActionClientDenied,
+	)
 	wantHeuristic(t, line, "deny_nets", `{"netblock": "`+clientsNet+`"}`)
 }
 
@@ -128,7 +142,11 @@ func TestRequestRefusedByDenyNetsIsNotCounted(t *testing.T) {
 		{listedAddr, http.StatusForbidden, requestlog.ActionClientDenied},
 		{listedAddr, http.StatusForbidden, requestlog.ActionClientDenied},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
+		{
+			unlistedAddr,
+			http.StatusForbidden,
+			requestlog.ActionClientIsRateLimited,
+		},
 	})
 }
 
@@ -152,7 +170,11 @@ func TestRateLimitExemptNetsAreNeitherCountedNorRefused(t *testing.T) {
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
+		{
+			unlistedAddr,
+			http.StatusForbidden,
+			requestlog.ActionClientIsRateLimited,
+		},
 		{fromKP, http.StatusForbidden, requestlog.ActionClientDenied},
 	})
 }
@@ -168,7 +190,12 @@ type sentRequest struct {
 // wantAnswers sends requests to sww at addr one after another and
 // checks each one's answer and log line. They must be the first requests
 // sww is sent, since the log lines are matched to them in order.
-func wantAnswers(t *testing.T, addr string, out *output, requests []sentRequest) {
+func wantAnswers(
+	t *testing.T,
+	addr string,
+	out *output,
+	requests []sentRequest,
+) {
 	t.Helper()
 
 	for i, sent := range requests {