Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/discriminator/answertime_test.go

@@ -23,10 +23,10 @@ import (
 )
 
 const (
-	// answerTimeLimit is the default of rproxy's SWRP_TIMEOUT_MS, the time
+	// answerTimeLimit is the default of rproxy's SWW_RPROXY_TIMEOUT_MS, the time
 	// discriminator has to answer.
 	answerTimeLimit = 2 * time.Second
-	// defaultLookupWait is the default of SWW_LOOKUP_TIMEOUT.
+	// defaultLookupWait is the default of SWW_WAF_LOOKUP_TIMEOUT.
 	defaultLookupWait = 800 * time.Millisecond
 	// The header limits SPEC.md gives.
 	cookieLimit      = 50
@@ -178,7 +178,7 @@ func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
 	for _, env := range []map[string]string{
 		{wafMode: off},
 		{wafMode: "detect"},
-		{wafMode: block, "SWW_WAF_EXEMPT_PATHS": "/"},
+		{wafMode: block, "SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS": "/"},
 	} {
 		t.Run(fmt.Sprint(env), func(t *testing.T) {
 			t.Parallel()
@@ -413,7 +413,7 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 		action string
 	}{
 		{
-			name: "SWW_DENY_NETS", env: map[string]string{denyNets: client},
+			name: "SWW_WAF_DENY_NETS", env: map[string]string{denyNets: client},
 			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionClientDenied,
 		},
 		{