Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/waf/rulefiles_test.go

@@ -34,14 +34,14 @@ func TestEachRuleAction(t *testing.T) {
 	line := s.get(client, http.StatusOK, requestlog.ActionForward)
 	wantRuleIDs(t, line, "noted")
 
-	// A block rule refuses with 403, whatever SWW_BAN_RESPONSE is, and
+	// A block rule refuses with 403, whatever SWW_WAF_BAN_RESPONSE is, and
 	// bans no one.
 	line = s.request(client, "/blocked", http.StatusForbidden,
 		requestlog.ActionBlockedByBlockRule)
 	wantRuleIDs(t, line, "noted", "blocked")
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	// A ban rule refuses with SWW_BAN_RESPONSE, and bans the client for
+	// A ban rule refuses with SWW_WAF_BAN_RESPONSE, and bans the client for
 	// seven days, the default.
 	line = s.request(client, "/.env", http.StatusTooManyRequests,
 		requestlog.ActionTemporarilyBanned)
@@ -132,7 +132,7 @@ func TestNextClearSignOfAttackAfterABanBansPermanently(t *testing.T) {
 		attackBanDuration: "1h",
 	})
 
-	// The first probe bans for SWW_ATTACK_BAN_DURATION.
+	// The first probe bans for SWW_WAF_ATTACK_BAN_DURATION.
 	line := s.request(client, "/.env", http.StatusForbidden,
 		requestlog.ActionTemporarilyBanned)
 	if line.BanExpires != requestlog.FormatTime(clk.Now().Add(time.Hour)) {
@@ -155,8 +155,8 @@ func TestRulesComeAfterTheOtherChecks(t *testing.T) {
 	t.Parallel()
 
 	const (
-		allowed = "192.0.2.60" // in SWW_ALLOW_NETS
-		exempt  = "192.0.2.50" // in SWW_RATE_LIMIT_EXEMPT_NETS
+		allowed = "192.0.2.60" // in SWW_WAF_ALLOW_NETS
+		exempt  = "192.0.2.50" // in SWW_WAF_RATE_LIMIT_EXEMPT_NETS
 	)
 
 	s, _, server := startWithClock(t, "", map[string]string{
@@ -166,7 +166,7 @@ func TestRulesComeAfterTheOtherChecks(t *testing.T) {
 		rateLimitPerMinute:  "1",
 	})
 
-	// A client in SWW_ALLOW_NETS is not checked.
+	// A client in SWW_WAF_ALLOW_NETS is not checked.
 	line := s.request(allowed, "/.env", http.StatusOK, requestlog.ActionForward)
 	wantRuleIDs(t, line)