rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

internal/config/rproxy_test.go

@@ -125,7 +125,19 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 		{rproxyDefault, "maybe"},
 		{rproxyListen, "8080"},
 		{rproxyUpstream, "app"},
+		{rproxyUpstream, "127.0.0.1:8081"},
+		{rproxyUpstream, "ftp://127.0.0.1:8081"},
+		{rproxyUpstream, "http://"},
+		{rproxyUpstream, "http://:8081"},
+		{rproxyUpstream, "http://127.0.0.1:0"},
+		{rproxyUpstream, "http://127.0.0.1:99999"},
+		{rproxyUpstream, "http://127.0.0.1:8081/app"},
+		{rproxyUpstream, "http://127.0.0.1:8081/?a=1"},
+		{rproxyUpstream, "http://user:secret@127.0.0.1:8081"},
 		{rproxyTrusted, "not a netblock"},
+		{rproxyTrusted, "10.0.0.0/33"},
+		{rproxyTrusted, "10.0.0.0/8,,192.168.0.0/16"},
+		{rproxyTrusted, "fe80::1%eth0"},
 		{rproxyMaxRequest, notASize},
 		{rproxyMaxResponse, notASize},
 		{rproxyRequestTime, "0"},
@@ -143,6 +155,19 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 	}
 }
 
+func TestRProxyTrustedProxiesSetButEmptyTrustNothing(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL, rproxyTrusted: ""})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
+	if len(cfg.TrustedProxies) != 0 {
+		t.Errorf("trusted proxies %v, want none", cfg.TrustedProxies)
+	}
+}
+
 func TestRProxyNeedsItsBackend(t *testing.T) {
 	t.Parallel()