waf: decide every visitor request within rproxy's timeout (closes #394)

The Core Rule Set is the one check whose time a visitor can stretch.
At paranoia level 4 it took over 2 s on a request with an 8 KiB
request line, three 8 KiB Cookie lines and a 64 KiB form body.
SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE now takes at most 8K. The
Core Rule Set also reads no JSON body over 1 KiB, since Coraza turns
JSON into up to 8 times its size in names and values. That brings
such a request under 1 s.

A test per kind of input times the Core Rule Set on the worst request
within the limits, at the slowest settings. SPEC.md lists the limits
that bound it.

Model: opus-5-5

SPEC.md

@@ -704,11 +704,12 @@ files, the limits and the bans still apply to the client that sends it.
       rules is loaded yet.
 
 - `SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE` switches body inspection on, up
-  to that size. It takes at most `64K`, since `waf` gets no more of a body than
-  that (see "The answer"). Form data and multipart bodies are read up to the
-  size. JSON and XML bodies are read only when no larger than the size, since
-  those cannot be read in part. Any other body is not read: the Core Rule Set
-  would read it as form data, where binary content such as a git push trips
+  to that size. It takes at most `8K`, so that `waf` answers in time (see
+  "Answering in time"). Form data and multipart bodies are read up to the size.
+  JSON and XML bodies are read only when no larger than the size, since those
+  cannot be read in part. A JSON body over 1 KiB is not read either, whatever
+  the size (see "Answering in time"). Any other body is not read: the Core Rule
+  Set would read it as form data, where binary content such as a git push trips
   rules written for text. A body the Core Rule Set cannot parse adds 5 to the
   score, and so does a multipart body cut by the limit in the middle of a part's
   header. Body inspection suits apps whose forms carry no code.
@@ -2397,9 +2398,7 @@ In `observe` mode a request that `enforce` mode would refuse is answered
 answered `404`.
 
 The Core Rule Set inspects the body a question carries only while
-`SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE` is set. It inspects at most 64 KiB
-less one byte. So it does not inspect a JSON or XML body of 64 KiB or more,
-which may have been cut short.
+`SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE` is set, and at most 8 KiB of it.
 
 ### Answering in time
 
@@ -2474,12 +2473,26 @@ client in `SWW_WAF_ALLOW_NETS` skips them, as it skips the Core Rule Set. In
 `observe` mode such a request is answered `allow` with `would_action`, and no
 other check runs on it.
 
-The Core Rule Set runs each of its rules on each cookie, so thousands of small
-cookies would keep it busy for over a second. One 30 KB cookie or query string
-would keep it busy for a third of a second or more. A request with several long
-`Cookie` lines, each within the limits, can keep it as busy. Enough such
-requests at once can still overload `waf` past
-`SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS`.
+The Core Rule Set is the one check a visitor can keep busy for long. It runs
+each of its rules on each part of a request, so thousands of small cookies would
+keep it busy for over a second. These fixed limits bound what it reads:
+
+- the header limits above;
+- `rproxy`'s limit of 32 KiB on the request line and headers together (see
+  "`rproxy`'s limits");
+- 8 KiB of a body, the most `SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE` takes,
+  or 1 KiB of a JSON body.
+
+Coraza names each value in a JSON body by the whole path to it, such as
+`json.users.0.name`. So the names and values the Core Rule Set reads in a JSON
+body can add up to more than the body. From 1 KiB of JSON, Coraza makes at most
+8 KiB of them, no more than the largest body of another kind.
+
+A request can reach all of these at once. At paranoia level 4, with no rule
+switched off, the Core Rule Set takes under a second on one core of a current
+server to inspect it. So `waf` answers it within the default 2 seconds, even
+after the default 800 milliseconds of waiting for GeoJS. Enough such requests at
+once can still overload `waf` past `SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS`.
 
 ### The report