servewaf always answers rproxy well within its time limit (closes #182)

A question waits on GeoJS at most 800ms, the new default of
SWWAF_LOOKUP_TIMEOUT. It does not wait at all when the checks will refuse
it whatever GeoJS answers. Just before the Core Rule Set, servewaf refuses
more than 50 cookies or 100 header fields with 431.

Shared default changed: SWWAF_LOOKUP_TIMEOUT also applies to smallwebwaf
with no command.
Judgement call: SWWAF_REPUTATION_TIMEOUT stays 2s, since no request waits
on the DNS blocklists or AbuseIPDB.

Model: opus-5-5

docs/request-log.md

@@ -67,7 +67,8 @@ Every line has:
       CrowdSec decision, each of which bans the client;
     - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
       refused by that check;
-    - `too_large` and `timed_out`: a size or time limit was passed;
+    - `too_large`: a size limit was passed, or a header limit in `servewaf`;
+    - `timed_out`: a time limit was passed;
     - `upstream_error`: the app could not be reached, or its answer broke off;
     - `admin`: answered at one of `smallwebwaf`'s own endpoints.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a