Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/discriminator/staticlists_test.go

@@ -26,7 +26,7 @@ func TestAllowNetsSkipEveryCheck(t *testing.T) {
 		calls.Add(1)
 	})
 	geojsURL, asked := startGeoJS(t)
-	// fromKP is in SWW_ALLOW_NETS, and in SWW_DENY_NETS too, which
+	// fromKP is in SWW_WAF_ALLOW_NETS, and in SWW_WAF_DENY_NETS too, which
 	// comes after it.
 	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
 		trustedProxies:     trustLocalhost,
@@ -36,7 +36,7 @@ func TestAllowNetsSkipEveryCheck(t *testing.T) {
 		rateLimitPerMinute: "1",
 	})
 
-	// Neither SWW_DENY_NETS, SWW_TAG_DENY nor the limit of one request a
+	// Neither SWW_WAF_DENY_NETS, SWW_WAF_TAG_DENY nor the limit of one request a
 	// minute refuses the client, and its country is not looked up.
 	wantAnswers(t, addr, out, []sentRequest{
 		{fromKP, http.StatusOK, requestlog.ActionForward},
@@ -147,7 +147,7 @@ func TestRateLimitExemptNetsAreNeitherCountedNorRefused(t *testing.T) {
 
 	// listedAddr's requests are neither refused nor counted, so the first
 	// request from unlistedAddr is within the limit of one a minute.
-	// SWW_TAG_DENY still refuses an exempt client.
+	// SWW_WAF_TAG_DENY still refuses an exempt client.
 	wantAnswers(t, addr, out, []sentRequest{
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{listedAddr, http.StatusOK, requestlog.ActionForward},