Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/waf/metrics_test.go

@@ -17,9 +17,9 @@ import (
 )
 
 const (
-	metricsToken = "SWW_METRICS_TOKEN" //nolint:gosec // the setting's name
-	metricsTopN  = "SWW_METRICS_TOP_N"
-	// token is the SWW_METRICS_TOKEN the tests set, and bearer how a
+	metricsToken = "SWW_WAF_METRICS_TOKEN" //nolint:gosec // the setting's name
+	metricsTopN  = "SWW_WAF_METRICS_TOP_N"
+	// token is the SWW_WAF_METRICS_TOKEN the tests set, and bearer how a
 	// request carries it.
 	token  = "0123456789abcdef0123456789abcdef"
 	bearer = "Bearer " + token
@@ -130,7 +130,7 @@ func TestMetricsCountTheTraffic(t *testing.T) {
 func TestMetricsCountLimitsAndBans(t *testing.T) {
 	t.Parallel()
 
-	const denied = "192.0.2.50" // in SWW_DENY_NETS
+	const denied = "192.0.2.50" // in SWW_WAF_DENY_NETS
 
 	s, clk, _ := startWithClock(t, "", map[string]string{
 		metricsToken:       token,
@@ -141,7 +141,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 		maxBanDuration:     "2h",
 	})
 
-	// SWW_BAN_RESPONSE=close sends no status at all.
+	// SWW_WAF_BAN_RESPONSE=close sends no status at all.
 	s.get(denied, 0, requestlog.ActionClientDenied)
 
 	// A first broken limit bans for an hour.
@@ -176,7 +176,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	wantMetric(t, s.scrape(), `sww_active_bans{instance="app"}`, 0)
 
 	// A limit broken again right after would ban for three hours, longer
-	// than SWW_MAX_BAN_DURATION, so the ban is permanent.
+	// than SWW_WAF_MAX_BAN_DURATION, so the ban is permanent.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, 0, requestlog.ActionClientIsRateLimited)
 
@@ -373,13 +373,13 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 			tagDeny:        denyKP,
 		})
 
-	// GeoJS fails, so the client has no country= tag, and SWW_TAG_DENY does
+	// GeoJS fails, so the client has no country= tag, and SWW_WAF_TAG_DENY does
 	// not refuse it.
 	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 	req.Header.Set(forwardedFor, fromDE)
 	wantStatus(t, do(t, req), http.StatusOK)
 
-	// The client stops waiting for GeoJS once SWW_LOOKUP_TIMEOUT is up, so
+	// The client stops waiting for GeoJS once SWW_WAF_LOOKUP_TIMEOUT is up, so
 	// GeoJS's failure can come after its request has ended.
 	deadline := time.Now().Add(waitLimit)
 	metrics := scrape(t, server.Addr)