rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

docs/state-files.md

@@ -7,7 +7,7 @@ Each has a top-level `version` of 1.
 ## `bans.json`
 
 Active and past bans: every ban an admin made, and up to `SWWAF_MAX_BANS` of
-those `smallwebwaf` made. Per entry:
+those `servewaf` made. Per entry:
 
 - `netblock`, `start` and `expires` (`null` for a permanent ban);
 - `cause`: `attack`, `limit`, `admin` or `crowdsec`;
@@ -63,8 +63,8 @@ since it was first seen:
 - total requests, and how many were forwarded and how many refused;
 - bytes in each direction;
 - responses by status class;
-- offences by kind: `limit`, `attack`, `rule_blocked`, `waf_blocked` and
-  `token_refused`.
+- offences by kind: `limit`, `attack`, `rule_blocked` and `waf_blocked`. A file
+  may also hold `token_refused`, which is kept, and which nothing adds to.
 
 ## `lookups.json`