Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/waf/abuseipdb.go

@@ -1,7 +1,7 @@
 package waf
 
-// The heuristic abuseipdb. It reads SWW_ABUSEIPDB_KEY,
-// SWW_ABUSEIPDB_MIN_SCORE and SWW_REPUTATION_ACTION.
+// The heuristic abuseipdb. It reads SWW_WAF_ABUSEIPDB_KEY,
+// SWW_WAF_ABUSEIPDB_MIN_SCORE and SWW_WAF_REPUTATION_ACTION.
 
 import (
 	"context"
@@ -16,12 +16,12 @@ import (
 
 // abuseIPDB adds the tag abuseipdb and notes AbuseIPDB, as noteHit does, with
 // the score, when its score of the client is a hit, and refuses the request
-// when SWW_REPUTATION_ACTION is deny, as dnsbl does for a zone. While
-// SWW_ABUSEIPDB_KEY is unset it does nothing. A client without a score is
+// when SWW_WAF_REPUTATION_ACTION is deny, as dnsbl does for a zone. While
+// SWW_WAF_ABUSEIPDB_KEY is unset it does nothing. A client without a score is
 // checked in the background, by the request's address, if its history counts
 // an offence, and the request does not wait for the answer. The score is then
 // used for each address of the client. Its figures are the score and
-// SWW_ABUSEIPDB_MIN_SCORE.
+// SWW_WAF_ABUSEIPDB_MIN_SCORE.
 type abuseIPDB struct{}
 
 func (abuseIPDB) name() string { return "abuseipdb" }
@@ -51,7 +51,7 @@ func (abuseIPDB) check(
 			Source: reputation.AbuseIPDBSource,
 			Score:  &score,
 		},
-		"scored by AbuseIPDB at or over SWW_ABUSEIPDB_MIN_SCORE",
+		"scored by AbuseIPDB at or over SWW_WAF_ABUSEIPDB_MIN_SCORE",
 	)
 
 	if rq.h.config.ReputationAction != deny {