Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/remotelog/remotelog_test.go

@@ -653,7 +653,7 @@ func wantRetries(t *testing.T, logged *output, delays ...string) {
 
 		err := json.Unmarshal([]byte(line), &fields)
 		if err != nil ||
-			fields["msg"] != "sending to SWW_LOG_REMOTE_URL failed" {
+			fields["msg"] != "sending to SWW_WAF_LOG_REMOTE_URL failed" {
 			t.Fatalf("logged %q", line)
 		}