Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/ratelimit/ratelimit.go

@@ -2,7 +2,7 @@
 // and bytes counted over a minute, an hour and a day, as the "Counting
 // method" section of SPEC.md describes, which tell when a request takes
 // the client over a rate limit or a byte limit, and each client's history
-// since it was first seen. At most SWW_MAX_TRACKED_CLIENTS clients are
+// since it was first seen. At most SWW_WAF_MAX_TRACKED_CLIENTS clients are
 // kept, in memory, and written to clients.json and read from it by the
 // state package.
 package ratelimit
@@ -157,7 +157,7 @@ type Request struct {
 }
 
 // New returns a Limiter for limits, with no client counted yet, whose
-// table holds at most maxClients clients (SWW_MAX_TRACKED_CLIENTS). Past
+// table holds at most maxClients clients (SWW_WAF_MAX_TRACKED_CLIENTS). Past
 // it, the least recently seen client is dropped, with its history, and
 // starts afresh if it comes back.
 func New(limits Limits, maxClients int) *Limiter {

internal/ratelimit/ratelimit_test.go

@@ -13,7 +13,7 @@ import (
 const limit = 3
 
 // tableSize is the most clients the tests' tables hold, the default of
-// SWW_MAX_TRACKED_CLIENTS.
+// SWW_WAF_MAX_TRACKED_CLIENTS.
 const tableSize = 20000
 
 // whole is the percentage of each limit a client gets when nothing lowers