rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171)

`smallwebwaf rproxy` reads the first 64 KiB of each body, asks servewaf, and
passes what servewaf allows to the app within its own size and time limits.
It reports each request servewaf answered. SWRP_DEFAULT_DISPOSITION decides
when servewaf gives no answer.

Duplication: internal/rproxy copies passing-on code from internal/proxy until
#172 removes the originals.
Rule suppressed: gosec G704 on servewaf's URL, a setting.
Rule suppressed: gosec G705 on the answer written to the visitor.
Judgement call: the SWRP_ size and time limits take off; SWRP_TIMEOUT_MS does not.

Model: opus-5-5

README.md

@@ -342,15 +342,19 @@ pinned.
   `127.0.0.1` and `::1` for forwarded headers, besides the private address
   ranges.
 - Both processes start with the container's environment variables, so every
-  setting of `smallwebwaf` starts with `SWWAF_`, and the app can read a token
-  given as one. A token given as a file that only the `smallwebwaf` user can
-  read is out of its reach (see "Settings given as files" in
+  setting of this `smallwebwaf` process starts with `SWWAF_`, and the app can
+  read a token given as one. A token given as a file that only the `smallwebwaf`
+  user can read is out of its reach (see "Settings given as files" in
   [`docs/settings.md`](docs/settings.md)).
 - The state files live in `/var/lib/smallwebwaf`. A volume mounted there keeps
   them across a deploy.
 - `smallwebwaf servewaf` runs the same checks for the sites that ask it about
   each request, and passes nothing to an app (see "`servewaf`" in
   [`SPEC.md`](SPEC.md)).
+- `smallwebwaf rproxy` is the reverse proxy in front of one app that asks
+  `smallwebwaf servewaf` about each request, and keeps the site answering while
+  `servewaf` is down. Its settings start with `SWRP_`, and it needs
+  `SWRP_WAF_BACKEND`, `servewaf`'s URL (see "`rproxy`" in [`SPEC.md`](SPEC.md)).
 - `docker stop` stops both processes at once. `smallwebwaf` gives the requests
   in progress five seconds to finish, so the app must keep answering for five
   seconds after `SIGTERM`.
@@ -363,8 +367,6 @@ what each does.
 ## TODO
 
 - Planned, as "Planned, not built" in [`SPEC.md`](SPEC.md) describes:
-    - `smallwebwaf rproxy`, the reverse proxy in front of each app that asks
-      `smallwebwaf servewaf` about each request;
     - sharing bans between the instances of several apps;
     - sending the log over RELP.