waf: refuse request lines and header lines over 8 KiB first (closes #339)

The header limits now also refuse a request line over 8 KiB with 414
(action request_line_too_long) and a header line over 8 KiB, Host
included, with 431. Like the other header limits they are fixed, run
first and make no ban. One long query string or cookie no longer keeps
the Core Rule Set busy for a third of a second.

Model: opus-5-5

README.md

@@ -540,9 +540,10 @@ request reaches the app.
 A refused visitor is answered with `SWW_WAF_BAN_RESPONSE`. A `block` rule or a
 Core Rule Set match answers `403` and bans nobody, since the Core Rule Set has
 false positives; such refusals count toward `SWW_WAF_REFUSALS_LIMIT_PER_MINUTE`
-instead. A request over the header limits of step 3 is answered `431`, and bans
-nobody either. `rproxy` itself answers `405` to a method it does not pass on,
-and the status for a size or time limit, such as `413` for a body too large.
+instead. A request over the header limits of step 3 is answered `414` for a
+request line over 8 KiB and `431` otherwise. It bans nobody either. `rproxy`
+itself answers `405` to a method it does not pass on, and the status for a size
+or time limit, such as `413` for a body too large.
 
 ### Clients and bans