Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/waf/trappaths_test.go

@@ -14,14 +14,14 @@ import (
 // trapPaths is the setting's name, and trapPathList what the tests set it
 // to.
 const (
-	trapPaths    = "SWW_TRAP_PATHS"
+	trapPaths    = "SWW_WAF_TRAP_PATHS"
 	trapPathList = "/wp-login.php,/xmlrpc.php"
 )
 
 func TestTrapPathBansAsABanRuleDoes(t *testing.T) {
 	t.Parallel()
 
-	const allowed = "192.0.2.60" // in SWW_ALLOW_NETS
+	const allowed = "192.0.2.60" // in SWW_WAF_ALLOW_NETS
 
 	// A block rule for the same path: the trap path comes first.
 	s, clk, server := startWithClock(t, "", map[string]string{
@@ -38,7 +38,7 @@ func TestTrapPathBansAsABanRuleDoes(t *testing.T) {
 		s.request(otherClient, path, http.StatusOK, requestlog.ActionForward)
 	}
 
-	// A client in SWW_ALLOW_NETS is not checked.
+	// A client in SWW_WAF_ALLOW_NETS is not checked.
 	s.request(
 		allowed,
 		"/xmlrpc.php",
@@ -153,8 +153,8 @@ func TestTrapPathsNeedNoRuleFiles(t *testing.T) {
 	t.Parallel()
 
 	s, _, _ := startWithClock(t, "", map[string]string{
-		trapPaths:           trapPathList,
-		"SWW_RULES_ENABLED": "false",
+		trapPaths:               trapPathList,
+		"SWW_WAF_RULES_ENABLED": "false",
 	})
 
 	s.request(client, "/xmlrpc.php", http.StatusForbidden,