Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/coreruleset/coreruleset_test.go

@@ -21,7 +21,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// defaultDisabledRules are the rules SWW_WAF_DISABLED_RULES switches off
+// defaultDisabledRules are the rules SWW_WAF_CORE_RULE_SET_DISABLED_RULES switches off
 // by default.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
@@ -650,17 +650,17 @@ var giteaFixed = []struct {
 	{get("/v2/owner/app/blobs/uploads/?from=python3"), matched(932260)},
 }
 
-// The hostnames of the tests of SWW_APPS: the one that serves gitea, and
+// The hostnames of the tests of SWW_WAF_APPS: the one that serves gitea, and
 // one that serves another app.
 const (
 	giteaHost = "git.example"
 	otherHost = "blog.example"
 )
 
-// gitea is gitea's name in SWW_APPS.
+// gitea is gitea's name in SWW_WAF_APPS.
 const gitea = "gitea"
 
-// wordpress is WordPress's name in SWW_APPS.
+// wordpress is WordPress's name in SWW_WAF_APPS.
 const wordpress = "wordpress"
 
 // withHost returns r sent to host.
@@ -672,7 +672,7 @@ func withHost(r request, host string) request {
 	}
 }
 
-// servingApps returns the Core Rule Set at the defaults, with SWW_APPS
+// servingApps returns the Core Rule Set at the defaults, with SWW_WAF_APPS
 // giving apps.
 func servingApps(
 	t *testing.T,
@@ -725,7 +725,7 @@ func TestUnlistedHostnameGetsTheFullCheck(t *testing.T) {
 
 	for _, apps := range []map[string][]string{
 		{giteaHost: {gitea}},
-		// SWW_APPS set empty lists no hostname.
+		// SWW_WAF_APPS set empty lists no hostname.
 		{},
 	} {
 		crs := servingApps(t, apps)
@@ -1166,7 +1166,7 @@ func misfiringPasswords(t *testing.T) []string {
 func wantRandomPasswordsPass(t *testing.T, r request, name string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	crs := readingBodies(t)
 	misfiring := misfiringPasswords(t)
@@ -1197,7 +1197,7 @@ func wantRandomPasswordsPass(t *testing.T, r request, name string) {
 func wantPasswordAttacksPass(t *testing.T, r request, names ...string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	for _, attack := range []string{
 		"' OR '1'='1", pathTraversal, "; cat /etc/passwd",
@@ -1217,7 +1217,7 @@ func wantPasswordAttacksPass(t *testing.T, r request, names ...string) {
 func wantPasswordAttacksRefused(t *testing.T, r request, name string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	for _, attack := range []string{scriptTag, "javascript:alert(1)"} {
 		body := passwordBody(t, r, []string{name}, attack)
@@ -1307,7 +1307,7 @@ func TestGiteaPasswordsPass(t *testing.T) {
 func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	crs := readingBodies(t)
 
@@ -1355,7 +1355,7 @@ func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
 func TestPasswordExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	crs := readingBodies(t)
 
@@ -1391,7 +1391,7 @@ func TestPasswordExclusionsAreNarrow(t *testing.T) {
 func TestGiteaAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	crs := atDefaults(t)
 
@@ -1471,7 +1471,7 @@ func TestGiteaSearchOnAUsersOrAnOrganisationsPageLetsLsThrough(
 	}
 
 	// A command after a ";" in q is still refused on each of these paths.
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	for _, target := range []string{
 		"/alice?tab=repositories&q=",
@@ -1496,7 +1496,7 @@ const (
 )
 
 // readingBodiesUpTo64K returns the Core Rule Set as sww runs it by default,
-// but reading bodies up to the largest SWW_WAF_BODY_LIMIT.
+// but reading bodies up to the largest SWW_WAF_CORE_RULE_SET_BODY_LIMIT.
 func readingBodiesUpTo64K(t *testing.T) *coreruleset.CoreRuleSet {
 	t.Helper()
 
@@ -1563,7 +1563,7 @@ func wordpressAttackTargets(attack string) []string {
 func TestWordPressAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t)
 
@@ -2301,7 +2301,7 @@ func TestWordPressExclusionsAreNarrow(t *testing.T) {
 	wantBody(t, crs, signIn, body, matched(930120), body)
 }
 
-// bodyLimit is SWW_WAF_BODY_LIMIT in the tests that read bodies.
+// bodyLimit is SWW_WAF_CORE_RULE_SET_BODY_LIMIT in the tests that read bodies.
 const bodyLimit = 8 << 10
 
 // The Content-Type headers of the kinds of body the Core Rule Set reads.
@@ -2739,7 +2739,7 @@ func giteaBranchNamesInBodies() []nameInBody {
 func TestGiteaNamesInBodiesStillRefuseAttacks(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	crs := readingBodies(t)