README and SPEC say a client too slow to send its request line and headers may get an error answer (closes #138)

A client too slow to send its request line and headers within
SWWAF_CLIENT_REQUEST_TIMEOUT gets either no answer or an error answer
from Go's server, mostly 400 Bad Request; either way its connection is
closed, nothing reaches the app, and no request log line is written.
The README's "Request log" and SPEC's size and time limits said such a
client always gets no answer. Both documents' summaries of
smallwebwaf's own answers now cover only limits passed after the
request line and headers have been read, and give 408 only for a slow
body; SPEC names Go's server as the one answering 431.

Model: opus-5-5

README.md

@@ -113,16 +113,16 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
   `X-Forwarded-Proto`, and `X-Forwarded-For` with the peer added at the end. It
   also gets the request's id in `X-Request-ID`, the same id as in the request's
   log line (see `request_id` in "Request log" below).
-- Enforces the timeouts and the size limits below. A limit passed before the
-  response has started gets `smallwebwaf`'s own answer: `408` for a client too
-  slow to send its request, `413` for a request body that is too large, `504`
-  for an app too slow to answer, and `502` for a response that is too large or
-  an app that cannot be reached. A request that announces a body over the limit
-  is refused before anything reaches the app. While a request body is still on
-  its way, a request timeout that runs out answers `408` if `smallwebwaf` was
-  waiting for the client to send more, and `504` if it was waiting for the app
-  to take what it had. Once the response has started, a limit can only cut the
-  connection.
+- Enforces the timeouts and the size limits below. Once a request's line and
+  headers have been read, a limit passed before the response has started gets
+  `smallwebwaf`'s own answer: `408` for a client too slow to send its body,
+  `413` for a request body that is too large, `504` for an app too slow to
+  answer, and `502` for a response that is too large or an app that cannot be
+  reached. A request that announces a body over the limit is refused before
+  anything reaches the app. While a request body is still on its way, a request
+  timeout that runs out answers `408` if `smallwebwaf` was waiting for the
+  client to send more, and `504` if it was waiting for the app to take what it
+  had. Once the response has started, a limit can only cut the connection.
 - Counts each client's requests over a minute, an hour and a day. A request that
   takes the client over one of the rate limits below is refused with
   `SWWAF_BAN_RESPONSE`, `403` by default, before anything reaches the app, and
@@ -1045,9 +1045,11 @@ less severe than `SWWAF_LOG_LEVEL` are not written.
 Go's HTTP server, on which `smallwebwaf` is built, reads a request's line and
 headers before `smallwebwaf` sees the request, and some requests end there,
 without a line in the log: headers over `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES`,
-which it answers `431`, headers slower than `SWWAF_CLIENT_REQUEST_TIMEOUT`,
-whose connection it closes without an answer, and requests it cannot read at
-all, which it answers itself, mostly with `400`.
+which it answers `431`, and requests it cannot read at all, which it answers
+itself, mostly with `400`. A client too slow to send its request line and
+headers within `SWWAF_CLIENT_REQUEST_TIMEOUT` gets either no answer or an error
+answer from the server, mostly `400 Bad Request`; either way the server closes
+its connection, nothing reaches the app, and no line is written in the log.
 
 ### Sending the log to a syslog server