servewaf always answers rproxy well within its time limit (closes #182)

A question waits on GeoJS at most 800ms, the new default of
SWWAF_LOOKUP_TIMEOUT. It does not wait at all when the checks will refuse
it whatever GeoJS answers. Just before the Core Rule Set, servewaf refuses
more than 50 cookies or 100 header fields with 431.

Shared default changed: SWWAF_LOOKUP_TIMEOUT also applies to smallwebwaf
with no command.
Judgement call: SWWAF_REPUTATION_TIMEOUT stays 2s, since no request waits
on the DNS blocklists or AbuseIPDB.

Model: opus-5-5

internal/lookup/lookup_test.go

@@ -72,6 +72,39 @@ func TestKeptAnswerIsUsedFor7DaysThenAskedAgain(t *testing.T) {
 	})
 }
 
+func TestLookUpWithoutWaitingAsksGeoJSAndGoesOnAtOnce(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		geojs, clock, g := start()
+		client := netip.MustParsePrefix("203.0.113.9/32")
+
+		// Wait is set, and GeoJS does not answer.
+		geojs.set(hanging)
+
+		began := time.Now()
+		answer := g.LookUpWithoutWaiting(t.Context(), client)
+
+		if waited := time.Since(began); waited != 0 || answer != (lookup.Answer{}) {
+			t.Errorf("got %+v after %s, want no answer at once", answer, waited)
+		}
+
+		waitForRequests(t, geojs, 1)
+		wantAsked(t, geojs, 0, "203.0.113.9")
+
+		// That request is abandoned, and has failed once this returns. GeoJS
+		// answers when it is asked again, and the answer is kept.
+		time.Sleep(timeout)
+		synctest.Wait()
+		geojs.set(answering)
+		waitForCountry(t, g, clock, client, germany)
+
+		if got := g.LookUpWithoutWaiting(t.Context(), client).Country; got != germany {
+			t.Errorf("the kept answer gives the country %q, want %q", got, germany)
+		}
+	})
+}
+
 func TestNewClientWaitsAtMostOneSecondThenCountsAsNotFound(t *testing.T) {
 	t.Parallel()
 
@@ -123,8 +156,8 @@ func TestRequestWaitsAsLongAsTheTimeoutSaysAndGeoJSIsAbandonedAfterIt(t *testing
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		// A timeout longer than the default second, and a GeoJS that does
-		// not answer.
+		// A timeout longer than the default, and a GeoJS that does not
+		// answer.
 		const longerTimeout = 3 * time.Second
 
 		m := metrics.New(1, "app")