rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

internal/proxy/lookup.go

@@ -9,11 +9,10 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 )
 
-// The headers in which the app is passed the client's AS number and
-// country while SWWAF_ADD_LOOKUP_HEADERS is set. Go writes every header
-// name in this form, as it sends it and as it receives it, so X-Client-ASN
-// arrives as X-Client-Asn, and Del removes a client's own whatever their
-// case; header names are not case-sensitive.
+// The headers in which an answer of allow gives rproxy the client's AS number
+// and country, for the app, while SWWAF_ADD_LOOKUP_HEADERS is set. Go writes
+// every header name in this form, as it sends it and as it receives it, so
+// X-Client-ASN arrives as X-Client-Asn; header names are not case-sensitive.
 const (
 	asnHeader     = "X-Client-Asn"
 	countryHeader = "X-Client-Country"
@@ -37,7 +36,7 @@ func (rq *request) lookUp(ctx context.Context, now time.Time) {
 	switch {
 	case rq.h.config.LookupSource == "file":
 		rq.lookupAnswer = rq.h.lookupFile.LookUp(client)
-	case rq.h.answersQuestions() && rq.refusedWhateverTheAnswer(now):
+	case rq.refusedWhateverTheAnswer(now):
 		rq.lookupAnswer = rq.h.geojs.LookUpWithoutWaiting(ctx, client)
 		rq.skippedLookupWait = rq.lookupAnswer.Answered.IsZero()
 	default:
@@ -60,8 +59,8 @@ func (h *handler) addLookup(answer lookup.Answer) {
 		answer.ASN, answer.ASName, answer.Country)
 }
 
-// setLookupHeaders sets the headers in which the app is passed the
-// client's AS number and country, leaving out one that is unknown.
+// setLookupHeaders sets the headers that give the client's AS number and
+// country, leaving out one that is unknown.
 func setLookupHeaders(header http.Header, asn, country string) {
 	if asn != "" {
 		header.Set(asnHeader, asn)