Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/discriminator/coreruleset.go

@@ -1,7 +1,7 @@
 package discriminator
 
-// The heuristic core_rule_set. It reads SWW_WAF_MODE, SWW_WAF_EXEMPT_PATHS
-// and SWW_WAF_ANOMALY_THRESHOLD.
+// The heuristic core_rule_set. It reads SWW_WAF_CORE_RULE_SET_MODE,
+// SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS and SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD.
 
 import (
 	"context"
@@ -14,13 +14,13 @@ import (
 )
 
 // coreRuleSet inspects the request with the Core Rule Set, unless
-// SWW_WAF_MODE is off or SWW_WAF_EXEMPT_PATHS exempts its path, as
-// pathExempt decides, and notes the rules it matched and its score in the
-// log line, and the rules in the metrics. A score at or over
-// SWW_WAF_ANOMALY_THRESHOLD is a match: it adds the tag exploitsignature,
-// raises the core_rule_set_match alert, and in block mode refuses the request with 403,
-// which is an offence its client's history counts. Its figures are the score
-// and the threshold.
+// SWW_WAF_CORE_RULE_SET_MODE is off or SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS
+// exempts its path, as pathExempt decides, and notes the rules it matched and
+// its score in the log line, and the rules in the metrics. A score at or over
+// SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD is a match: it adds the tag
+// exploitsignature, raises the core_rule_set_match alert, and in block mode
+// refuses the request with 403, which is an offence its client's history
+// counts. Its figures are the score and the threshold.
 type coreRuleSet struct{}
 
 func (coreRuleSet) name() string { return "core_rule_set" }
@@ -67,10 +67,10 @@ func (coreRuleSet) check(_ context.Context, rq *request, _ time.Time) *verdict {
 }
 
 // alertCoreRuleSetMatch raises the core_rule_set_match alert for the request,
-// which the Core Rule Set scored at result, at or over SWW_WAF_ANOMALY_THRESHOLD. Its
-// detail gives the rule ids, the score, the method and the path with the
-// query, and, for a request that is not refused for it, the mode: detect,
-// or observe in observe mode.
+// which the Core Rule Set scored at result, at or over
+// SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD. Its detail gives the rule ids, the
+// score, the method and the path with the query, and, for a request that is
+// not refused for it, the mode: detect, or observe in observe mode.
 func (rq *request) alertCoreRuleSetMatch(result coreruleset.Result) {
 	detail := map[string]any{
 		"rule_ids": result.RuleIDs,
@@ -94,7 +94,8 @@ func (rq *request) alertCoreRuleSetMatch(result coreruleset.Result) {
 		ASN:      rq.line.ASN,
 		ASName:   rq.line.ASName,
 		Country:  rq.line.Country,
-		Reason:   "scored by the Core Rule Set at or over SWW_WAF_ANOMALY_THRESHOLD",
-		Detail:   detail,
+		Reason: "scored by the Core Rule Set at or over " +
+			"SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD",
+		Detail: detail,
 	})
 }