Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

docs/image.md

@@ -20,7 +20,7 @@ way.
   `share/sww.run`.
 - `/var/lib/sww` for `waf`'s state files, and `/etc/sww/rules.d` with the
   default rule file `share/rules.d/00-default.rules`. The `run` script makes
-  `SWW_STATE_DIR` when it is missing.
+  `SWW_WAF_STATE_DIR` when it is missing.
 - `EXPOSE 8080`, and the `HEALTHCHECK` that runs `sww healthcheck`.
 
 ## Pins