Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/trappaths_test.go

@@ -39,15 +39,27 @@ func TestTrapPathBansAsABanRuleDoes(t *testing.T) {
 	}
 
 	// A client in SWW_ALLOW_NETS is not checked.
-	s.request(allowed, "/xmlrpc.php", http.StatusOK, requestlog.ActionForward)
+	s.request(
+		allowed,
+		"/xmlrpc.php",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 
 	// The query is not part of the path.
-	line := s.request(client, "/wp-login.php?redirect_to=x", http.StatusTooManyRequests,
-		requestlog.ActionTemporarilyBanned)
+	line := s.request(
+		client,
+		"/wp-login.php?redirect_to=x",
+		http.StatusTooManyRequests,
+		requestlog.ActionTemporarilyBanned,
+	)
 	wantRuleIDs(t, line)
 
 	if line.BanExpires != requestlog.FormatTime(start.Add(7*24*time.Hour)) {
-		t.Errorf("log line has ban_expires %q, want seven days on", line.BanExpires)
+		t.Errorf(
+			"log line has ban_expires %q, want seven days on",
+			line.BanExpires,
+		)
 	}
 
 	netblock := netip.MustParsePrefix(client + "/32")
@@ -77,36 +89,63 @@ func TestTrapPathBansAsABanRuleDoes(t *testing.T) {
 	}
 
 	// The next request is refused under the ban, and makes it permanent.
-	line = s.get(client, http.StatusTooManyRequests, requestlog.ActionPermanentlyBanned)
+	line = s.get(
+		client,
+		http.StatusTooManyRequests,
+		requestlog.ActionPermanentlyBanned,
+	)
 	if line.BanExpires != permanent {
-		t.Errorf("log line has ban_expires %q, want permanent", line.BanExpires)
+		t.Errorf(
+			"log line has ban_expires %q, want permanent",
+			line.BanExpires,
+		)
 	}
 }
 
 func TestTrapPathRefusalNamesItsHeuristicAndPath(t *testing.T) {
 	t.Parallel()
 
-	s, _, _ := startWithClock(t, "", map[string]string{trapPaths: trapPathList})
+	s, _, _ := startWithClock(
+		t,
+		"",
+		map[string]string{trapPaths: trapPathList},
+	)
 
-	line := s.request(client, "/wp-login.php?redirect_to=x", http.StatusForbidden,
-		requestlog.ActionTemporarilyBanned)
+	line := s.request(
+		client,
+		"/wp-login.php?redirect_to=x",
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 	wantHeuristic(t, line, "trap_paths", `{"path": "/wp-login.php"}`)
 }
 
 func TestTrapPathMatchesThePathDecodedOnce(t *testing.T) {
 	t.Parallel()
 
-	s, _, server := startWithClock(t, "", map[string]string{trapPaths: trapPathList})
+	s, _, server := startWithClock(
+		t,
+		"",
+		map[string]string{trapPaths: trapPathList},
+	)
 
 	// %2577 decodes once to %77, not to w.
-	s.request(otherClient, "/%2577p-login.php", http.StatusOK, requestlog.ActionForward)
+	s.request(
+		otherClient,
+		"/%2577p-login.php",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	s.request(client, "/%77p-login.php", http.StatusForbidden,
 		requestlog.ActionTemporarilyBanned)
 
 	// The ban's notes give the path as the client sent it.
 	got := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
 	if len(got) != 1 || got[0].Notes.TrapPath != "/%77p-login.php" {
-		t.Fatalf("bans %+v, want one whose notes give the trap path /%%77p-login.php", got)
+		t.Fatalf(
+			"bans %+v, want one whose notes give the trap path /%%77p-login.php",
+			got,
+		)
 	}
 }
 
@@ -130,7 +169,12 @@ func TestObserveModeLogsWhatATrapPathWouldDo(t *testing.T) {
 		mode:      observe,
 	})
 
-	line := s.request(client, "/xmlrpc.php", http.StatusOK, requestlog.ActionForward)
+	line := s.request(
+		client,
+		"/xmlrpc.php",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
 
 	// No ban was made.