Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/discriminator/request.go

@@ -44,7 +44,7 @@ type decision struct {
 	lookedUp     bool
 	lookupAnswer lookup.Answer
 	// skippedLookupWait is true for a request that did not wait for GeoJS and
-	// found no answer kept. SWW_UNKNOWN_LIMIT_PERCENT does not apply to it,
+	// found no answer kept. SWW_WAF_UNKNOWN_LIMIT_PERCENT does not apply to it,
 	// so that not waiting never lowers its client's limits.
 	skippedLookupWait bool
 	// counted is true for a request the rate limits counted, whose bytes
@@ -170,7 +170,7 @@ func requestHeaders(r *http.Request, names []string) map[string]string {
 
 // check is the one place where a request can be refused. It returns nil to let
 // the request through. The heuristics of checkClient decide: a request they
-// refuse is answered with SWW_BAN_RESPONSE, 403 for a block rule or the Core
+// refuse is answered with SWW_WAF_BAN_RESPONSE, 403 for a block rule or the Core
 // Rule Set, or 431 for the header limits. In observe mode nothing is refused,
 // and the log line names what enforce mode would have done. ctx is the
 // request's own context.
@@ -200,7 +200,7 @@ func (rq *request) check(ctx context.Context) *refusal {
 // checkClient runs the heuristics of beforeLookup on the request, then looks
 // up the client's AS number and country, then runs those of afterLookup. It
 // returns the first verdict, or nil when none gives one. A client in
-// SWW_ALLOW_NETS skips them all, and is not looked up. ctx is the request's
+// SWW_WAF_ALLOW_NETS skips them all, and is not looked up. ctx is the request's
 // own context.
 func (rq *request) checkClient(ctx context.Context) *verdict {
 	if isInside(rq.client, rq.h.config.AllowNets) {
@@ -224,7 +224,7 @@ func (rq *request) checkClient(ctx context.Context) *verdict {
 }
 
 // pathExempt reports whether r is exempt under prefixes,
-// SWW_RATE_LIMIT_EXEMPT_PATHS or SWW_WAF_EXEMPT_PATHS: whether its
+// SWW_WAF_RATE_LIMIT_EXEMPT_PATHS or SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS: whether its
 // path as sent, the path the app receives, not percent-decoded, starts
 // with one of prefixes, so that /%61ssets/x is not under /assets/ for an
 // app whose router matches the path as received. A request whose decoded
@@ -326,9 +326,9 @@ func (rq *request) addToHistory() {
 
 // countAnomalies counts the request, which has ended, and its bytes, as
 // countedBytes gives them, for the anomaly thresholds, whatever was done
-// with it: a request refused, one from a client in SWW_ALLOW_NETS or
-// SWW_RATE_LIMIT_EXEMPT_NETS, and one for a path in
-// SWW_RATE_LIMIT_EXEMPT_PATHS are counted too. It is counted for its
+// with it: a request refused, one from a client in SWW_WAF_ALLOW_NETS or
+// SWW_WAF_RATE_LIMIT_EXEMPT_NETS, and one for a path in
+// SWW_WAF_RATE_LIMIT_EXEMPT_PATHS are counted too. It is counted for its
 // client's AS number when answerAtTheEnd gives one. With every anomaly
 // threshold off, the default, it does nothing.
 func (rq *request) countAnomalies() {