rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

docs/rules.md

@@ -54,14 +54,19 @@ empty-agent      user_agent  log     ^$
 
 ## A file of your own
 
-An app's `Dockerfile` adds rules of its own in a file named to sort after the
-default, such as `50-gitea.rules`:
+`servewaf` reads the rule files in its own container. Rules of your own go in a
+file named to sort after the default, such as `50-gitea.rules`:
 
 ```
 # 50-gitea.rules: WordPress probes, which gitea never serves
 wp-probe         path        ban     (?i)^/(wp-login\.php|xmlrpc\.php|wp-admin/)
 ```
 
+A `Dockerfile` built on the `smallwebwaf` image, for `servewaf` to run from,
+adds it:
+
 ```dockerfile
 COPY 50-gitea.rules /etc/smallwebwaf/rules.d/50-gitea.rules
 ```
+
+Or mount it there. A `path` rule applies on every site behind that `servewaf`.