rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

internal/proxy/coreruleset.go

@@ -1,9 +1,6 @@
 package proxy
 
 import (
-	"errors"
-	"net/http"
-	"os"
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
@@ -19,8 +16,7 @@ import (
 // SWWAF_WAF_ANOMALY_THRESHOLD is a match: it raises the waf_block alert,
 // and in block mode refuses the request, which is an offence its client's
 // history counts, and so returns ActionWAFBlocked. It returns "" for a
-// request it does not refuse, and for one whose body meets a size or time
-// limit while the Core Rule Set reads it, which it notes nothing of.
+// request it does not refuse.
 func (rq *request) checkCoreRuleSet() string {
 	cfg := rq.h.config
 	if cfg.WAFMode == config.WAFModeOff || pathExempt(rq.in, cfg.WAFExemptPaths) {
@@ -29,10 +25,10 @@ func (rq *request) checkCoreRuleSet() string {
 
 	start := time.Now()
 
-	result := rq.inspect()
-	if rq.refused.Load() != nil {
-		return "" // the refusal for that limit, which check returns
-	}
+	// A question's body has been read into memory, so that reading it here
+	// cannot fail.
+	result, read, _ := rq.h.coreRuleSet.Inspect(rq.in, rq.client, rq.in.Body)
+	rq.requestBytes = int64(len(read))
 
 	rq.line.DurationWAF = new(requestlog.Milliseconds(time.Since(start)))
 	rq.line.WAFRuleIDs = result.RuleIDs
@@ -58,39 +54,6 @@ func (rq *request) checkCoreRuleSet() string {
 	return requestlog.ActionWAFBlocked
 }
 
-// inspect runs the Core Rule Set on the request, which reads the part of
-// its body it inspects within SWWAF_CLIENT_REQUEST_TIMEOUT, and keeps that
-// part for the app. A client that runs out of time is refused with 408
-// here, and a body over SWWAF_REQUEST_MAX_BYTES with 413 as it is read;
-// check returns the refusal. A body that breaks off for any other reason
-// is passed on as far as it came, and the request to the app fails there,
-// as it would have without the Core Rule Set.
-func (rq *request) inspect() waf.Result {
-	if rq.body == nil {
-		// Nothing is read of no body, so nothing can go wrong reading it.
-		result, _, _ := rq.h.coreRuleSet.Inspect(rq.in, rq.client, http.NoBody)
-
-		return result
-	}
-
-	_ = rq.rc.SetReadDeadline(rq.clientRequestDeadline())
-	result, read, err := rq.h.coreRuleSet.Inspect(rq.in, rq.client, rq.body)
-	// The timeouts that run while the request goes to the app take over.
-	_ = rq.rc.SetReadDeadline(time.Time{})
-
-	rq.body.readByCoreRuleSet = read
-
-	if errors.Is(err, os.ErrDeadlineExceeded) {
-		rq.refuse(refusal{
-			status: http.StatusRequestTimeout,
-			action: requestlog.ActionTimedOut,
-			limit:  "SWWAF_CLIENT_REQUEST_TIMEOUT",
-		})
-	}
-
-	return result
-}
-
 // alertWAFBlock raises the waf_block alert for the request, which the Core
 // Rule Set scored at result, at or over SWWAF_WAF_ANOMALY_THRESHOLD. Its
 // detail gives the rule ids, the score, the method and the path with the