rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171)

`smallwebwaf rproxy` reads the first 64 KiB of each body, asks servewaf over
HTTP/1.1, and passes what servewaf allows to the app within its limits. Any
other answer goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION
decides only when servewaf cannot be connected to, does not answer at all, or
does not answer within SWRP_TIMEOUT_MS. A method SPEC.md does not list gets 405.

Duplication: internal/rproxy copies passing-on code from internal/proxy until
#172 removes the originals.
Rule suppressed: gosec G704 and G705; gosec at
internal/smallwebwaf/rproxy_test.go:431; tagliatelle at
internal/requestlog/requestlog.go:201; paralleltest on one test.
Judgement call: an answer over 1 MiB, or with a status below 200, gets 502.
Judgement call: every target not starting with one / gets 400.

Model: opus-5-5

internal/config/config.go

@@ -1,7 +1,9 @@
-// Package config reads smallwebwaf's settings. Every setting is an
-// environment variable whose name starts with SWWAF_, or a file such a
-// variable names, every setting has a default, and this package is the
-// one place they are read.
+// Package config reads smallwebwaf's settings, and is the one place they are
+// read. Every setting is an environment variable. The settings of
+// `smallwebwaf` and `smallwebwaf servewaf` start with SWWAF_, every one of them
+// has a default, and most can be given as a file instead. Those of `smallwebwaf
+// rproxy` start with SWRP_. Each of them but SWRP_WAF_BACKEND has a default, and
+// none can be given as a file, since rproxy never touches disk.
 package config
 
 import (