servewaf answers rproxy's question about each request and takes its report (closes #170)

`smallwebwaf servewaf` runs today's checks on the visitor's request each
question carries, answers rproxy, and passes nothing to an app. rproxy reports
every request servewaf answered. A report counts an allowed request's bytes and
writes servewaf's second log line. The table holds a copy of what a report
needs, never the request, so a report cannot reach a request being handled.

Judgement call: a question's body is read before any check; over 64 KiB gets 400.
Judgement call: a report's bytes and durations have ceilings, so they cannot overflow.
Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close.

Model: opus-5-5

internal/proxy/metrics_test.go

@@ -207,7 +207,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 		rateLimitPerMinute:  "1",
 		rateLimitExemptNets: scraper,
 		denyNets:            denied,
-		banResponse:         "close",
+		banResponse:         banResponseClose,
 		limitBanDuration:    "1h",
 		maxBanDuration:      "2h",
 	})