Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/coreruleset/coreruleset_test.go

@@ -21,7 +21,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// defaultDisabledRules are the rules SWW_WAF_DISABLED_RULES switches off
+// defaultDisabledRules are the rules SWW_WAF_CORE_RULE_SET_DISABLED_RULES switches off
 // by default.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
@@ -815,7 +815,7 @@ func misfiringPasswords(t *testing.T) []string {
 func wantRandomPasswordsPass(t *testing.T, r request, name string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	crs := readingBodies(t)
 	misfiring := misfiringPasswords(t)
@@ -846,7 +846,7 @@ func wantRandomPasswordsPass(t *testing.T, r request, name string) {
 func wantPasswordAttacksPass(t *testing.T, r request, names ...string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	for _, attack := range []string{
 		"' OR '1'='1", pathTraversal, "; cat /etc/passwd",
@@ -866,7 +866,7 @@ func wantPasswordAttacksPass(t *testing.T, r request, names ...string) {
 func wantPasswordAttacksRefused(t *testing.T, r request, name string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	for _, attack := range []string{scriptTag, "javascript:alert(1)"} {
 		body := passwordBody(t, r, []string{name}, attack)
@@ -938,7 +938,7 @@ func TestGiteaPasswordsPass(t *testing.T) {
 func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	crs := readingBodies(t)
 
@@ -986,7 +986,7 @@ func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
 func TestPasswordExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	crs := readingBodies(t)
 
@@ -1013,7 +1013,7 @@ func TestPasswordExclusionsAreNarrow(t *testing.T) {
 func TestGiteaAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	crs := atDefaults(t)
 
@@ -1070,7 +1070,7 @@ const (
 )
 
 // readingBodiesUpTo64K returns the Core Rule Set as sww runs it by default,
-// but reading bodies up to the largest SWW_WAF_BODY_LIMIT.
+// but reading bodies up to the largest SWW_WAF_CORE_RULE_SET_BODY_LIMIT.
 func readingBodiesUpTo64K(t *testing.T) *coreruleset.CoreRuleSet {
 	t.Helper()
 
@@ -1137,7 +1137,7 @@ func wordpressAttackTargets(attack string) []string {
 func TestWordPressAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t)
 
@@ -1696,7 +1696,7 @@ func TestWordPressExclusionsAreNarrow(t *testing.T) {
 	wantBody(t, crs, signIn, body, matched(930120), body)
 }
 
-// bodyLimit is SWW_WAF_BODY_LIMIT in the tests that read bodies.
+// bodyLimit is SWW_WAF_CORE_RULE_SET_BODY_LIMIT in the tests that read bodies.
 const bodyLimit = 8 << 10
 
 // The Content-Type headers of the kinds of body the Core Rule Set reads.