Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/waf/waf.go

@@ -40,7 +40,7 @@ const (
 	// headers and body.
 	DispositionDeny = "deny"
 	// DispositionClose tells rproxy to close the visitor's connection
-	// without an answer, which SWW_BAN_RESPONSE asks for when it is close.
+	// without an answer, which SWW_WAF_BAN_RESPONSE asks for when it is close.
 	// waf closing the question's connection instead would read as
 	// waf being down, and rproxy would then let the request through.
 	DispositionClose = "close"
@@ -227,7 +227,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 // readQuestion returns the visitor's address and the body a question carries,
 // and whether waf takes the question. It answers a question it does not
 // take with 400 and no disposition. rproxy passes that 400 to the visitor,
-// and SWRP_DEFAULT_DISPOSITION does not apply. The id of a question waf takes
+// and SWW_RPROXY_DEFAULT_DISPOSITION does not apply. The id of a question waf takes
 // is held from here on, without a decision yet, so that another question with
 // that id is refused while this one is being handled.
 //
@@ -322,7 +322,7 @@ func asTheVisitorSentIt(r *http.Request, body []byte) *http.Request {
 }
 
 // allow answers a question with DispositionAllow and, while
-// SWW_ADD_LOOKUP_HEADERS is set, the client's AS number and country.
+// SWW_WAF_ADD_LOOKUP_HEADERS is set, the client's AS number and country.
 func (rq *request) allow() {
 	rq.allowed = true
 
@@ -348,7 +348,7 @@ func (rq *request) deny(r refusal) {
 	rq.refused = &r
 
 	if r.status == 0 {
-		// SWW_BAN_RESPONSE is close. Written past rq.out, since the log line's
+		// SWW_WAF_BAN_RESPONSE is close. Written past rq.out, since the log line's
 		// status stays 0: the visitor is sent nothing.
 		rq.out.Header().Set(DispositionHeader, DispositionClose)
 		rq.out.ResponseWriter.WriteHeader(http.StatusOK)