Request log: write & < > as sent (closes #327)

Request lines of `waf` and `rproxy` now hold `&`, `<` and `>` as sent, where `json.Marshal` wrote `\u0026`, `\u003c` and `\u003e`, and are still valid JSON. `writeJSONLine` encodes with a `json.Encoder` that has HTML escaping off, and still writes each line in one write. This follows the `AGENTS.md` rule that the request log records query strings exactly as received, and lets `grep` find a logged query string.

Alert webhooks and the report `rproxy` posts to `waf` are unchanged: neither is a request line, and both are read only by a JSON parser.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -5,6 +5,7 @@
 package requestlog
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -252,14 +253,20 @@ func WriteRProxyLine(w io.Writer, line *RProxyLine) error {
 	return writeJSONLine(w, line)
 }
 
-// writeJSONLine writes line to w as one JSON line.
+// writeJSONLine writes line to w as one JSON line. It writes "&", "<" and
+// ">" as they are, so a query string reads as it was sent.
 func writeJSONLine(w io.Writer, line any) error {
-	encoded, err := json.Marshal(line)
+	var encoded bytes.Buffer
+
+	encoder := json.NewEncoder(&encoded)
+	encoder.SetEscapeHTML(false)
+
+	err := encoder.Encode(line)
 	if err != nil {
 		return fmt.Errorf("encode the request log line: %w", err)
 	}
 
-	_, err = w.Write(append(encoded, '\n'))
+	_, err = w.Write(encoded.Bytes())
 	if err != nil {
 		return fmt.Errorf("write the request log line: %w", err)
 	}